token-minter
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches external dependencies and configurations required for blockchain deployment.
- Fetches the OpenZeppelin contracts library, a standard and trusted resource in the Ethereum ecosystem, using
forge install. - Retrieves EVM network RPC information from the well-known community service at
https://chainlist.org/rpcs.json. - [DYNAMIC_EXECUTION]: The skill dynamically generates and compiles executable code at runtime.
- Uses
scripts/generate_contract.pyto format a Solidity template with user-provided parameters. - Executes the Foundry
forge buildcommand to compile the generated Solidity source code into EVM bytecode. - [INDIRECT_PROMPT_INJECTION]: The skill incorporates user-supplied data into code generation and shell commands, creating a potential surface for injection.
- Ingestion points: User-provided parameters (name, symbol, decimals, and initial supply) are collected in
SKILL.md. - Boundary markers: None. The workflow does not use delimiters or instructions to prevent the agent from obeying embedded instructions in user strings.
- Capability inventory: The skill uses
pythonfor script execution and theforgetoolchain for file system operations (writing tosrc/), dependency management, and network transactions (forge create). - Sanitization:
scripts/generate_contract.pycastsdecimalsandinitial_supplyto integers, which provides type validation. However, thenameandsymbolstrings are interpolated directly into the Solidity template without escaping or sanitization. - [COMMAND_EXECUTION]: The skill executes several shell commands as part of the token development lifecycle.
- Runs
forge init,forge install,forge build, andforge createto manage the smart contract project and deploy to the blockchain.
Audit Metadata