create-aptos-project
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
npx create-aptos-dappandaptos initto generate project structures and initialize network settings. - [EXTERNAL_DOWNLOADS]: Downloads the official scaffolding utility from the npm registry during execution.
- [INDIRECT_PROMPT_INJECTION]: The skill contains an indirect prompt injection surface. 1. Ingestion points: The
<project-name>,<network>, and--api-keyinputs are derived from user instructions in SKILL.md. 2. Boundary markers: None present; variables are interpolated directly into shell commands. 3. Capability inventory: Commands include shell execution vianpx,aptos, andgitacross multiple steps in SKILL.md. 4. Sanitization: Recommends kebab-case for names but does not include explicit shell escaping logic. - [SAFE]: The skill instructions mandate verifying
.gitignorefor.envfiles and explicitly forbid the agent from reading or displaying private keys.
Audit Metadata