afterself
Warn
Audited by Gen Agent Trust Hub on Mar 21, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of local Node.js scripts to manage state, interact with the Solana blockchain, and handle the encrypted vault. Core logic is driven by shell command execution (e.g., node {baseDir}/scripts/state.js).
- [COMMAND_EXECUTION]: The 'Executor' functionality includes a 'close_account' action that utilizes browser automation guided by natural language instructions. This allows the agent to perform complex, multi-step interactions on external websites on behalf of the user based on stored plans.
- [COMMAND_EXECUTION]: The mortality pool feature includes a script (mortality.js) that can transfer all user tokens to a hardcoded pool wallet address upon triggering the dead man's switch.
- [DATA_EXFILTRATION]: The 'custom' action type allows the agent to send user-defined JSON payloads to arbitrary webhooks. While intended for integration purposes, this provides a mechanism for data to be transmitted out of the local environment to external servers.
- [PROMPT_INJECTION]: The 'Ghost Mode' feature processes untrusted input from external messaging channels. (1) Ingestion points: Incoming messages are processed in references/ghost-persona-prompt.md via the {incomingMessage} variable. (2) Boundary markers: The skill uses boundary markers (<<<INCOMING_MESSAGE>>>) to delimit untrusted input. (3) Capability inventory: The agent has access to messaging tools, file system state management, and the encrypted vault. (4) Sanitization: The system prompt instructs the model to ignore instructions within the markers and provides fallback responses for confusing or blocked topics.
Audit Metadata