skills/aibtcdev/skills/clarity-check/Gen Agent Trust Hub

clarity-check

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates the execution of a local TypeScript script (clarity-check/clarity-check.ts) using the bun runtime and leverages the clarinet CLI to perform contract validation. These actions are consistent with the skill's stated purpose as a developer tool.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of Clarity smart contract source files, which presents a surface for indirect prompt injection.
  • Ingestion points: Contract files are ingested through the --source parameter in the validate and checklist subcommands.
  • Boundary markers: The skill generates structured JSON output, which serves as a delimiter to prevent the agent from misinterpreting data as instructions.
  • Capability inventory: The skill has the capability to read local files and execute specific scripts; it is explicitly described as read-only and lacks network or file-write capabilities.
  • Sanitization: No explicit sanitization of contract content is mentioned, but the use of structured output and static analysis methodology significantly limits the exploitation surface.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 05:03 AM