agentbox-provision
Warn
Audited by Gen Agent Trust Hub on Mar 4, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill's Node.js script (
provision.mjs) reads a Solanawallet.jsonfile containing a 64-byte private key array. This exposes highly sensitive financial credentials to the agent's script execution context to sign blockchain transactions for the $5 USDC fee. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of external Node.js packages including
@x402/fetch,@x402/svm, and@solana/kit. These packages are used to manage x402-based payments and interact with the Solana blockchain and theapi.agentbox.fyiendpoint. - [COMMAND_EXECUTION]: The provided code uses
process.argvto accept file paths andreadFileSyncto load them from the disk. This pattern constitutes sensitive file access, as it enables the script to read arbitrary files from the local filesystem if the provided path is not strictly validated.
Audit Metadata