ton-blueprint
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill interacts with external resources such as the official TON community GitHub repository to fetch verifier configurations (https://raw.githubusercontent.com/ton-community/contract-verifier-config/main/config.json). These are legitimate resources within the TON ecosystem.
- [CREDENTIALS_UNSAFE]: The documentation guides users to store sensitive information like WALLET_MNEMONIC in .env files. This is documented as a standard practice for secret management in development environments to avoid hardcoding credentials.
- [COMMAND_EXECUTION]: The skill details the use of the blueprint CLI, which executes commands for building, testing, and running scripts (blueprint build, blueprint test, blueprint run). These are core functionalities of the development tool described.
- [INDIRECT_PROMPT_INJECTION]: The skill describes processes that involve ingesting and compiling smart contract source code. While this constitutes an attack surface, it is the primary purpose of the tool and is used within the context of a development framework.
Audit Metadata