deployer
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use
forgeandcastCLI tools for compiling, encoding, and broadcasting blockchain transactions. It explicitly mandates user approval for every transaction and warns against auto-approving shell tools. - [EXTERNAL_DOWNLOADS]: The skill involves cloning the official Uniswap CCA repository (
github.com/Uniswap/continuous-clearing-auction.git) to access deployment scripts and contract source code. This is a standard operation for building from source. - [INDIRECT_PROMPT_INJECTION]: The skill processes JSON configuration files and user-provided parameters. It mitigates potential injection risks by providing the agent with strict validation rules, including regex checks for addresses and numbers, and a list of forbidden shell metacharacters (e.g.,
;,|,&,$). - [SAFE]: The skill promotes security best practices, such as using hardware wallets or encrypted keystores (via
cast wallet import) rather than exposing private keys through insecure command-line flags or history-persistent methods.
Audit Metadata