jupiter-token-verification
Pass
Audited by Gen Agent Trust Hub on Mar 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill integrates with official Jupiter subdomains (jup.ag) for token verification services. All API interactions are directed to legitimate vendor infrastructure, and no unauthorized data exfiltration or credential theft patterns were detected.
- [EXTERNAL_DOWNLOADS]: The skill's documentation includes a TypeScript example that references the '@solana/web3.js' library. This is a well-known, trusted package within the Solana ecosystem and is used here for standard blockchain interactions.
- [PROMPT_INJECTION]: The skill retrieves token descriptions and rejection reasons from an external API. This represents an indirect prompt injection surface (Category 8). However, the risk is negligible as the agent is instructed only to display this text to the user, and the skill lacks capabilities that could be maliciously triggered by the ingested data.
- [COMMAND_EXECUTION]: A developer code example provided in the skill demonstrates reading a local file for a wallet keypair. This is standard functionality for standalone blockchain scripts and is not an automated behavior performed by the AI agent during user interactions.
Audit Metadata