Whale Wallet Copier
Fail
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill contains a hardcoded Etherscan API key. This credential is provided as a default fallback in the
__init__methods of multiple scripts. - File:
scripts/transaction_monitor.py - Evidence:
self.etherscan_api_key = etherscan_api_key or "S61W6QK13ZPENIB91MKQ669MAZQS5WH552" - File:
scripts/whale_performance_tracker.py - Evidence:
self.etherscan_api_key = etherscan_api_key or "S61W6QK13ZPENIB91MKQ669MAZQS5WH552" - [EXTERNAL_DOWNLOADS]: The skill retrieves data from well-known external blockchain services.
- Fetches Ethereum transaction history from Etherscan.
- Retrieves token pricing and analytics from DexScreener.
- Accesses CoinGecko for supplemental price information.
- [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection (Category 8).
- Ingestion points: The skill ingests untrusted string-based metadata such as token names and symbols from DexScreener and transaction logs from Etherscan.
- Boundary markers: None. The skill formats raw external metadata directly into reports and alerts without using delimiters or protective warnings.
- Capability inventory: The skill possesses network communication capabilities via the
requestslibrary and the ability to write JSON files to the local file system. - Sanitization: No sanitization, validation, or escaping of the retrieved metadata is performed before the data is processed or displayed to the user/agent.
Recommendations
- AI detected serious security threats
Audit Metadata