hardhat-tron
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends dependencies from established blockchain development organizations, including
@layerzerolabsand@nomicfoundation. These are well-known services within the ecosystem, and the skill references specific, versioned packages which align with standard development workflows. - [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted local content by instructing the agent on how to manage contracts and deployment scripts.
- Ingestion points: Solidity source files and JavaScript deployment scripts located in the local project directory.
- Boundary markers: None explicitly provided within the skill instructions.
- Capability inventory: Subprocess calls to the Hardhat CLI (
npx hardhat) for contract compilation, automated testing, and network deployment. - Sanitization: The skill relies on the built-in validation and sanitization provided by the Hardhat framework and the Solidity compiler.
- [SAFE]: Credential management is handled securely by advising the use of environment variables (
process.env.TRON_PRIVATE_KEYandprocess.env.TRON_PRO_API_KEY) via thedotenvpackage, effectively preventing the hardcoding of sensitive secrets in the codebase.
Audit Metadata