genesis-token
Warn
Audited by Snyk on Mar 4, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The backend checkWalletForSGT function in references/sgt-verification.md explicitly queries a public Helius RPC (HELIUS_RPC_URL) via getTokenAccountsByOwnerV2 and parses token account and mint metadata—ingesting untrusted, user/third-party blockchain data that directly influences verification decisions.
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). Yes. The skill explicitly integrates Solana wallet functionality (Sign-in-with-Solana), signature verification, RPC queries (Helius), and checking NFT (SGT) ownership using @solana libraries. Those are specific crypto/blockchain wallet and signing APIs—not generic browser or HTTP tooling—so it grants direct blockchain wallet interaction capabilities (a direct financial-execution category per the rules).
Audit Metadata