arete-stack-authoring
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the vendor-provided
a4CLI and the standard Rustcargotoolchain to perform various tasks. - Evidence: Commands such as
a4 idl summary,a4 idl relations,a4 config validate,cargo check, andcargo buildare used to inspect data and compile artifacts. - [DYNAMIC_EXECUTION]: The skill involves generating and compiling code based on external definitions using Rust macros.
- Evidence: The instructions specify that the "DSL is compiled by Rust macros" and that
cargo buildshould be used to generate content-addressed artifacts under the.arete/directory. - [INDIRECT_PROMPT_INJECTION]: The skill processes external Solana program Interface Definition Language (IDL) files, which serves as an ingestion point for untrusted data.
- Ingestion points:
idl/<program>.jsonfiles are consumed by thea4CLI and the#[arete(idl = [...])]Rust macro. - Boundary markers: The skill encourages the use of machine-readable IDL analysis and local artifact validation (
a4 config validate) before further use. - Capability inventory: The skill performs local file writes to
.arete/and executes local build commands (cargo build). - Sanitization: Users are instructed to verify instruction account names independently and document cross-account update routes against the IDL.
Audit Metadata