aiken-smart-contracts
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses platform-specific command execution in the YAML frontmatter context field to run 'aiken --version' and 'aiken --help'. These commands are used to inform the AI agent of the available tool versions and capabilities at load time and do not involve sensitive data or untrusted input.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to take user requirements and generate smart contract code, creating a surface for indirect prompt injection.
- Ingestion points: User requests for specific validator logic (e.g., time-locks or pubkey constraints).
- Boundary markers: The instructions do not define specific delimiters for separating user requirements from generated code templates.
- Capability inventory: The skill allows the agent to write files ('Write') and execute shell commands for building and testing contracts ('Bash(aiken:)', 'Bash(cardano-cli:)').
- Sanitization: The skill relies on the underlying model's safety guardrails for code generation; no explicit sanitization logic is provided in the workflow.
Audit Metadata