productclank-campaigns
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes external social media content and user-provided guidelines to generate AI replies, creating an indirect injection surface. * Ingestion points: The reply_guidelines field in SKILL.md and API_REFERENCE.md, and post_text fetched from external platforms. * Boundary markers: The skill includes a dedicated Safety Note in SKILL.md instructing agents to treat these fields as content style hints only. * Capability inventory: Executes network requests to api.productclank.com and handles blockchain transactions for funding. * Sanitization: Documentation states server-side generation is sandboxed and advises agents to ignore behavioral overrides in the guidelines.
- [EXTERNAL_DOWNLOADS]: The skill documentation and examples recommend installing several established third-party libraries for blockchain interaction and HTTP requests. * Evidence: Mentions viem, ethers, and @x402/fetch in references/EXAMPLES.md for payment and API handling.
- [COMMAND_EXECUTION]: The skill includes a utility script for campaign management and funding operations. * Evidence: The scripts/create-campaign.mjs file is a Node.js script intended to be executed by the agent or user to interact with the ProductClank API and facilitate USDC payments on the Base network.
Audit Metadata