tenderly
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a technical integration guide for the Tenderly platform, offering well-structured TypeScript examples and documentation for various DevOps tasks.
- [EXTERNAL_DOWNLOADS]: The documentation references official vendor tools and standard industry libraries, such as
@tenderly/actions-cli,viem,ethers, andaxios. These are appropriate and necessary for the development of blockchain applications and automation. - [CREDENTIALS_UNSAFE]: Secret management is handled correctly throughout the examples. It utilizes environment variables (e.g.,
process.env.TENDERLY_ACCESS_KEY) and Tenderly's project-scoped secret store (context.secrets.get) to avoid hardcoding sensitive information like API keys or private keys. - [DATA_EXFILTRATION]: Outbound network requests are restricted to the official Tenderly API (
api.tenderly.co) and user-configured notification targets (Slack, webhooks). These operations are essential to the skill's stated purpose of monitoring and debugging transactions. - [PROMPT_INJECTION]: The skill demonstrates processing external data, such as blockchain logs and webhook payloads, which technically constitutes an indirect prompt injection surface. However, the skill provides defensive code examples, including payload validation and cryptographic signature verification, to mitigate risks associated with processing untrusted external inputs.
Audit Metadata