ethereum-jsonrpc-skill

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches the official Ethereum execution OpenRPC schema from the Ethereum organization's public GitHub repository (ethereum/execution-apis). This is a trusted source for API definitions.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with a well-known public Ethereum RPC provider (ethereum-rpc.publicnode.com) to perform read-only operations on the blockchain.
  • [COMMAND_EXECUTION]: The skill uses the uxc tool to create local command aliases (e.g., ethereum-jsonrpc-cli) that facilitate structured interaction with the RPC endpoint.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from the Ethereum blockchain, such as block headers and transaction logs. While this data originates from untrusted external sources, the skill emphasizes structured JSON-RPC parsing and stable field extraction, which mitigates the risk of instructions embedded in chain data influencing the agent.
  • Ingestion points: JSON-RPC response data from methods like eth_getBlockByNumber and eth_getLogs (processed in SKILL.md).
  • Boundary markers: The instructions explicitly advise keeping automation on the JSON output envelope and parsing stable fields first, providing a layer of isolation between raw data and agent logic.
  • Capability inventory: The skill uses uxc for network requests and allows writing subscription event streams to local files in $HOME/.uxc/subscriptions/ (as seen in references/usage-patterns.md).
  • Sanitization: The skill relies on the structured nature of the JSON-RPC protocol and OpenRPC schema validation to ensure data integrity.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 10:15 PM