goldrush-x402
Pass
Audited by Gen Agent Trust Hub on Mar 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@x402/coreand@x402/evmNode.js packages to manage the x402 payment flow. These are vendor-specific libraries associated with the Covalent GoldRush ecosystem. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface by processing untrusted data from the blockchain.
- Ingestion points: Transaction history, token metadata, and event logs retrieved from the
x402.goldrush.devproxy via theHTTPClientinSKILL.md. - Boundary markers: No specific delimiters or instructions are provided to the agent to treat the fetched blockchain data as untrusted content.
- Capability inventory: The skill utilizes network GET requests to retrieve external data and present it to the agent context.
- Sanitization: There is no evidence of sanitization or filtering of the retrieved blockchain data before it is processed by the AI agent.
Audit Metadata