token-minter

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches external dependencies and configurations required for blockchain deployment.
  • Fetches the OpenZeppelin contracts library, a standard and trusted resource in the Ethereum ecosystem, using forge install.
  • Retrieves EVM network RPC information from the well-known community service at https://chainlist.org/rpcs.json.
  • [DYNAMIC_EXECUTION]: The skill dynamically generates and compiles executable code at runtime.
  • Uses scripts/generate_contract.py to format a Solidity template with user-provided parameters.
  • Executes the Foundry forge build command to compile the generated Solidity source code into EVM bytecode.
  • [INDIRECT_PROMPT_INJECTION]: The skill incorporates user-supplied data into code generation and shell commands, creating a potential surface for injection.
  • Ingestion points: User-provided parameters (name, symbol, decimals, and initial supply) are collected in SKILL.md.
  • Boundary markers: None. The workflow does not use delimiters or instructions to prevent the agent from obeying embedded instructions in user strings.
  • Capability inventory: The skill uses python for script execution and the forge toolchain for file system operations (writing to src/), dependency management, and network transactions (forge create).
  • Sanitization: scripts/generate_contract.py casts decimals and initial_supply to integers, which provides type validation. However, the name and symbol strings are interpolated directly into the Solidity template without escaping or sanitization.
  • [COMMAND_EXECUTION]: The skill executes several shell commands as part of the token development lifecycle.
  • Runs forge init, forge install, forge build, and forge create to manage the smart contract project and deploy to the blockchain.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 04:27 PM