token-allowance
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/allowance.pyuses thesubprocess.check_callmethod to execute a command-line operation that installs missing Python dependencies. - [EXTERNAL_DOWNLOADS]: If the
web3library is not present, the skill automatically downloads and installs it from the official Python Package Index (PyPI) via pip. - [CREDENTIALS_UNSAFE]: The tool accepts a
private_keyas a direct input parameter, which is a sensitive credential. While this is necessary for its functionality (signing blockchain transactions), providing private keys as plain-text arguments to tools can lead to exposure in agent logs or session histories. The skill also reads sensitive keys from thePRIVATE_KEYenvironment variable.
Audit Metadata