use-smart-contract-platform
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources such as smart contract queries and event webhooks, which could potentially contain malicious instructions.
- Ingestion points: External data enters the agent context via
scpClient.queryContract()and through webhook event monitoring as described in the implementation patterns. - Boundary markers: No explicit delimiters or boundary markers are defined in the instructions to isolate untrusted external content from the system prompt.
- Capability inventory: The skill possesses significant capabilities, including deploying smart contracts from bytecode and executing write transactions on multiple blockchains.
- Sanitization: Security rules in the skill mandate validation of all inputs (addresses, amounts, chain IDs) and require explicit user confirmation for write transactions and fund movements.
- [EXTERNAL_DOWNLOADS]: The skill installs dependencies from the official npm registry.
- Evidence: The installation command fetches
@circle-fin/smart-contract-platformand@circle-fin/developer-controlled-wallets. These are official SDKs provided by Circle for their platform services.
Audit Metadata