chainlink-ccip-skill
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content, creating a potential surface for indirect prompt injection attacks.
- Ingestion points: The skill utilizes the
WebFetchtool and the@chainlink/mcp-serverto retrieve documentation, API responses, and blockchain data at runtime (documented in the 'Documentation Access' and 'Safety Guardrails' sections). - Boundary markers: The instructions explicitly include a defense-in-depth guardrail (Safety Guardrail #11) requiring the agent to treat all external documentation and tool outputs as untrusted data.
- Capability inventory: The agent has the capability to
WriteandEditlocal files (source code and contracts) based on the ingested untrusted data. - Sanitization: The skill mandates that the agent must ignore any embedded instructions within retrieved data that request credential access, shell execution, or modifications to the safety guardrails.
Audit Metadata