crypto-com-app
Pass
Audited by Gen Agent Trust Hub on Mar 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, vulnerabilities, or deceptive behaviors were detected. The skill's operations are transparent and consistent with its stated purpose.
- [COMMAND_EXECUTION]: The skill executes local TypeScript scripts for all API interactions. This is the required mechanism for generating HMAC SHA256 signatures for authentication and for processing structured API responses.
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto execute scripts, which may fetch thetsxpackage from the official npm registry. This is a standard development practice and uses a well-known, trusted package repository. - [CREDENTIALS_UNSAFE]: The skill correctly avoids hardcoding secrets, requiring the user to provide
CDC_API_KEYandCDC_API_SECRETvia environment variables. - [PROMPT_INJECTION]: The skill includes defensive confirmation logic for trades and account changes (e.g., the 'CONFIRM KILL SWITCH' phrase), ensuring that high-impact actions are not executed without explicit, intentional user consent.
Audit Metadata