erc-8004
Warn
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Multiple scripts, including
register-http.sh,register-onchain.sh, andupdate-profile.sh, construct Node.js commands by directly interpolating shell variables (such asREGISTRATION_URL,AGENT_NAME, andNEW_URI) into single-quoted string literals within anode -ecall. This lacks proper escaping, allowing for arbitrary JavaScript execution if the input variables are manipulated to contain a single quote followed by malicious code. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface via the following evidence chain:
- Ingestion points: The
get-agent.shscript fetches external content from IPFS gateways (pinata.cloud,ipfs.io) or HTTPS URLs retrieved from on-chain agent records. - Boundary markers: None; the fetched profile data is printed directly to the console output.
- Capability inventory: The skill has the capability to perform financial transactions and bridge ETH between networks using the
bankrtool. - Sanitization: None; untrusted data from the web or IPFS is processed and displayed without validation, which could influence the behavior of an agent reading the output.
Audit Metadata