turbo-transforms

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides documentation and examples for using the fetch_abi and _gs_fetch_abi SQL functions. These functions are designed to retrieve ABI (Application Binary Interface) or IDL (Interface Definition Language) JSON files from remote URLs to enable the decoding of blockchain logs and instructions.
  • [DYNAMIC_EXECUTION]: The skill documents the use of type: script transforms, which allow for the execution of custom TypeScript logic. According to the documentation, this code is transpiled to JavaScript and executed within a WASM sandbox that restricts network access and external imports to maintain security boundaries.
  • [DATA_EXFILTRATION]: The skill includes patterns for type: handler transforms and type: webhook sinks, which facilitate sending data to external HTTP endpoints. These are standard features for data enrichment and alerting within the Goldsky pipeline ecosystem.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes a platform architecture that ingests untrusted blockchain data (sources like matic.raw_logs or solana.instructions) and processes it using transforms with executable capabilities (WASM scripts) and network capabilities (HTTP handlers).
  • Ingestion points: Dataset sources defined in YAML configurations (e.g., base.logs, base.erc20_transfers).
  • Boundary markers: Not explicitly defined in the instruction templates.
  • Capability inventory: Support for custom TypeScript execution (WASM) and external HTTP requests via handlers and webhooks.
  • Sanitization: The skill primarily focuses on structured data transformations (SQL/TypeScript) rather than natural language processing, which reduces the immediate risk of instruction injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 05:15 PM