smart-contract-security
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a resource list from the author's GitHub repository (
gmh5225/awesome-web3-security). This is a legitimate vendor resource used to provide up-to-date auditing materials. - [INDIRECT_PROMPT_INJECTION]: The skill ingests content from an external URL which introduces a potential surface for indirect prompt injection if the remote content were to contain malicious instructions.
- Ingestion points: The agent is instructed to fetch resources from
https://raw.githubusercontent.com/gmh5225/awesome-web3-security/refs/heads/main/README.mdinSKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present for the fetched data.
- Capability inventory: The skill does not define dangerous capabilities like subprocess execution, file writes, or credential access.
- Sanitization: There is no evidence of sanitization or validation performed on the remote markdown content before it is processed.
- Ingestion points: The agent is instructed to fetch resources from
Audit Metadata