security-audit
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the aptos CLI to perform contract compilation and testing. These commands are integral to the audit process and represent standard development practices.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided Move source code, which constitutes a potential injection surface. 1. Ingestion points: Smart contract source code files. 2. Boundary markers: A structured 7-category checklist is used to guide the audit. 3. Capability inventory: The skill uses local CLI tools; no network exfiltration patterns were identified. 4. Sanitization: The skill contains explicit 'NEVER' rules to prevent the agent from accessing sensitive files such as ~/.aptos/config.yaml or .env.
- [SAFE]: No malicious patterns, obfuscation, or unauthorized remote code execution were detected. The skill is authored by a recognized entity in the blockchain ecosystem.
Audit Metadata