bridge-stablecoin
Pass
Audited by Gen Agent Trust Hub on Apr 23, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and installs official packages from the @circle-fin vendor namespace, including @circle-fin/bridge-kit, @circle-fin/adapter-viem-v2, @circle-fin/adapter-solana-kit, and @circle-fin/adapter-circle-wallets.
- [COMMAND_EXECUTION]: Provides standard npm installation commands for dependency setup.
- [DATA_EXFILTRATION]: Identifies requirements for sensitive credentials such as PRIVATE_KEY and CIRCLE_API_KEY. The skill explicitly forbids hardcoding or logging these secrets and instructs the use of environment variables.
- [PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection through user-controllable transaction parameters. Ingestion points: kit.bridge() arguments in SKILL.md and reference files. Boundary markers: provided via instructional rules rather than code delimiters. Capability inventory: blockchain fund transfers (USDC bridging). Sanitization: mitigated by mandatory security rules requiring input validation and user confirmation.
- [SAFE]: The implementation includes a robust set of security rules that enforce best practices, such as warning users about mainnet transactions and requiring validation of all addresses and amounts before execution.
Audit Metadata