NYC

onchainkit

Fail

Audited by Gen Agent Trust Hub on Feb 16, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION] (HIGH): The skill executes npm create onchain@latest which downloads and runs remote code from the npm registry. As the developer (Coinbase) is not on the trusted whitelist, this is classified as execution of unverifiable remote scripts.
  • [EXTERNAL_DOWNLOADS] (MEDIUM): The script scripts/setup-environment.py performs runtime installation of the @coinbase/onchainkit package during environment setup.
  • [COMMAND_EXECUTION] (LOW): Multiple scripts utilize subprocess.run to execute system commands for project initialization and validation. While input validation (alphanumeric check) is present for project names, shell command execution via agent-mediated scripts remains a risk factor.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Feb 16, 2026, 06:10 AM