foundry-solidity
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a library of knowledge and documentation for Ethereum smart contract development. All instructions provided are legitimate technical guidance for using the Foundry toolkit (Forge, Cast, Anvil, Chisel) and Solidity 0.8.30.
- [DATA_EXPOSURE]: The skill follows security best practices for credential management, consistently instructing users to use environment variables (
vm.envUint("PRIVATE_KEY")) and secret management systems (GitHub Secrets) rather than hardcoding sensitive data. - [COMMAND_EXECUTION]: The skill provides numerous examples of shell commands for building, testing, and deploying contracts. These commands are standard for the Foundry ecosystem and are used in their intended context for developer workflows.
- [INDIRECT_PROMPT_INJECTION]: As an AI assistant skill for code development, this skill has an inherent attack surface where it processes user-provided Solidity files and project configurations. This represents a standard indirect injection surface common to coding tools, which can be mitigated by the agent's built-in safety guardrails.
- Ingestion points: Project files including
src/*.sol,test/*.t.sol, andfoundry.toml. - Boundary markers: The documentation uses standard Markdown formatting; explicit instructions to ignore embedded instructions in user data are not present but are expected to be handled by the platform.
- Capability inventory: Access to shell via
forge,cast,anvil, andchiselcommands. - Sanitization: The skill provides a library of knowledge; sanitization of user input is handled by the underlying agent platform.
Audit Metadata