gas
Fail
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: CRITICALMETADATA_POISONINGCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill provides deceptive time-context. It presents Ethereum gas price tables from 'Early 2026' and a 'verified' date of 2026-03-17, despite the description stating it describes building on Ethereum 'today'. This misleading information could lead users to misjudge current network transaction costs.
- [COMMAND_EXECUTION]: The skill directs the agent to execute shell commands using the
castutility (part of the Foundry toolkit) to retrieve live network state. Examples includecast base-feeandcast gas-priceexecuted against hardcoded RPC endpoints. - [EXTERNAL_DOWNLOADS]: The skill initiates network synchronization with the RPC endpoint
https://eth.llamarpc.comand references official data feeds from Chainlink for pricing information. - [INDIRECT_PROMPT_INJECTION]: The skill establishes an ingestion point for untrusted blockchain data that enters the agent's context.
- Ingestion points: Raw output from the
castCLI command (file: SKILL.md). - Boundary markers: Absent; the tool's output is directly integrated into the prompt context for cost estimation.
- Capability inventory: The skill relies on command execution to process and act upon network-retrieved values.
- Sanitization: No validation or sanitization logic is provided to verify the integrity of the data returned by the external RPC provider.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata