gas

Fail

Audited by Gen Agent Trust Hub on Oct 28, 2026

Risk Level: CRITICALMETADATA_POISONINGCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [METADATA_POISONING]: The skill provides deceptive time-context. It presents Ethereum gas price tables from 'Early 2026' and a 'verified' date of 2026-03-17, despite the description stating it describes building on Ethereum 'today'. This misleading information could lead users to misjudge current network transaction costs.
  • [COMMAND_EXECUTION]: The skill directs the agent to execute shell commands using the cast utility (part of the Foundry toolkit) to retrieve live network state. Examples include cast base-fee and cast gas-price executed against hardcoded RPC endpoints.
  • [EXTERNAL_DOWNLOADS]: The skill initiates network synchronization with the RPC endpoint https://eth.llamarpc.com and references official data feeds from Chainlink for pricing information.
  • [INDIRECT_PROMPT_INJECTION]: The skill establishes an ingestion point for untrusted blockchain data that enters the agent's context.
  • Ingestion points: Raw output from the cast CLI command (file: SKILL.md).
  • Boundary markers: Absent; the tool's output is directly integrated into the prompt context for cost estimation.
  • Capability inventory: The skill relies on command execution to process and act upon network-retrieved values.
  • Sanitization: No validation or sanitization logic is provided to verify the integrity of the data returned by the external RPC provider.
Recommendations
  • CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
  • Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Oct 28, 2026, 02:26 AM