Contract Audit
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches contract data and source code from Etherscan's API (api.etherscan.io) and queries the official Base RPC (mainnet.base.org). These are well-known, trusted services for blockchain development.
- [COMMAND_EXECUTION]: Utilizes
curlandjqin shell blocks to interact with external APIs and parse JSON responses. These operations are scoped to public blockchain data retrieval. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of smart contract source code and ABIs retrieved from the Etherscan API. It mitigates risk through explicit developer instructions to treat this content as untrusted and avoid unsafe interpolation into commands, using
jqfor structured field extraction instead of raw string processing.
Audit Metadata