web3-testing
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process Solidity smart contract source code for testing and auditing. This creates a surface for indirect prompt injection where malicious instructions could be embedded in contract comments or metadata to influence agent behavior.
- Ingestion points: Smart contract source files (
.sol) and project configurations processed by the agent. - Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded content within the contracts being tested.
- Capability inventory: The skill utilizes shell execution for testing frameworks (Hardhat, Forge) and file system access for coverage reports.
- Sanitization: No sanitization or filtering of contract content is specified before processing.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute various command-line tools for blockchain development and testing.
- Evidence: Usage of
npx hardhat test,npx hardhat coverage, and Forge CLI commands for executing test suites.
Audit Metadata