productclank-campaigns
Pass
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill documentation includes a dedicated safety section for the
reply_guidelinesfield, correctly identifying it as untrusted user input. It provides clear instructions to the agent to treat this field as scoped only to style and tone, preventing potential behavioral overrides through indirect prompt injection. - [EXTERNAL_DOWNLOADS]: The skill utilizes standard, well-known Node.js libraries such as
viemand@x402/fetchfor blockchain interactions and payment processing. It also provides a link to its official CLI on GitHub for user reference. - [COMMAND_EXECUTION]: A helper script (
create-campaign.mjs) is provided to streamline the campaign creation process. This script performs routine network operations to the official ProductClank API endpoints and does not execute arbitrary or dangerous shell commands. - [DATA_EXFILTRATION]: All network communications are directed to legitimate service domains (
productclank.com,base.llamarpc.com) necessary for the skill's functionality. The handling of API keys and private keys via environment variables follows standard security practices for this type of integration.
Audit Metadata