fund
Warn
Audited by Gen Agent Trust Hub on Feb 21, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- EXTERNAL_DOWNLOADS (MEDIUM): The skill makes extensive use of
npx awal@latestto perform wallet operations. This pattern downloads and executes code from the npm registry at runtime without a verified publisher or version pinning. - Evidence: Found in
allowed-toolsand multiple Bash code blocks withinSKILL.md. - COMMAND_EXECUTION (LOW): The skill explicitly defines and requests the ability to execute shell commands via the Bash tool to interact with the wallet companion app.
- Evidence:
allowed-toolsconfiguration in YAML frontmatter.
Audit Metadata