example-hello-world
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute an installation script (
compact-installer.sh) directly from the official Midnight Network GitHub repository to install the required compiler tooling. - [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where external data (e.g., messages stored in the contract) is processed by the agent's tooling without explicit sanitization or boundary markers.
- Ingestion points:
src/test/hw.test.ts(message strings passed into contract circuit calls during testing). - Boundary markers: Absent.
- Capability inventory: Shell-level execution of the
compactcompiler,docker compose, andyarnpackage manager. - Sanitization: No input sanitization or validation logic is implemented in the boilerplate code.
- [CREDENTIALS_UNSAFE]: The skill includes hardcoded placeholder values for sensitive data intended for local development and testing, such as a static seed (
ALICE_SEED) and a private state storage password (xK9#mQ2$pL8@nR5!vW3*). - [COMMAND_EXECUTION]: The skill relies on shell commands for core functionality, including smart contract compilation, Docker-based environment management, and running test suites via the CLI.
Audit Metadata