p2p
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external Binance API responses, such as merchant nicknames and order descriptions, which could theoretically contain malicious instructions. To mitigate this risk, the skill mandates an explicit human-in-the-loop confirmation process for all write operations, including advertisement publication and appeal evidence submission. Additionally, it enforces strict data filtering rules to ensure sensitive counterparty PII is never exposed to the user.
- [EXTERNAL_DOWNLOADS]: The skill performs routine network operations to official Binance domains (
api.binance.com,www.binance.com) for version verification and market data retrieval. These operations are conducted over secure channels to verified vendor infrastructure. - [CREDENTIALS_UNSAFE]: The skill provides comprehensive guidance on the secure handling of Binance API credentials. It instructs the agent to use environment variables, protect secret files using standard version control exclusions (e.g.,
.gitignore), and enforces specific masking requirements when displaying API keys or secrets in the user interface.
Audit Metadata