ethereum-jsonrpc-skill
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the official Ethereum execution OpenRPC schema from the Ethereum organization's public GitHub repository (
ethereum/execution-apis). This is a trusted source for API definitions. - [EXTERNAL_DOWNLOADS]: The skill interacts with a well-known public Ethereum RPC provider (
ethereum-rpc.publicnode.com) to perform read-only operations on the blockchain. - [COMMAND_EXECUTION]: The skill uses the
uxctool to create local command aliases (e.g.,ethereum-jsonrpc-cli) that facilitate structured interaction with the RPC endpoint. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from the Ethereum blockchain, such as block headers and transaction logs. While this data originates from untrusted external sources, the skill emphasizes structured JSON-RPC parsing and stable field extraction, which mitigates the risk of instructions embedded in chain data influencing the agent.
- Ingestion points: JSON-RPC response data from methods like
eth_getBlockByNumberandeth_getLogs(processed inSKILL.md). - Boundary markers: The instructions explicitly advise keeping automation on the JSON output envelope and parsing stable fields first, providing a layer of isolation between raw data and agent logic.
- Capability inventory: The skill uses
uxcfor network requests and allows writing subscription event streams to local files in$HOME/.uxc/subscriptions/(as seen inreferences/usage-patterns.md). - Sanitization: The skill relies on the structured nature of the JSON-RPC protocol and OpenRPC schema validation to ensure data integrity.
Audit Metadata