migrate-hardhat2-to-hardhat3
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill correctly implements the official migration process for development tools and follows security best practices for handling project secrets.
- [COMMAND_EXECUTION]: The skill executes standard local commands (Hardhat, TypeScript, and package managers) to migrate the codebase. These actions are performed within a controlled multi-phase workflow requiring user validation and approval at checkpoints.
- [EXTERNAL_DOWNLOADS]: Project dependencies are updated by installing official packages from the @nomicfoundation and hardhat organizations. These are recognized vendor resources and part of the normal operation of the tool.
- [CREDENTIALS_UNSAFE]: The skill promotes secure environment variable management through Hardhat's configVariable system and Keystore plugin. It explicitly warns against committing environment files and hardcoding sensitive information.
- [SAFE]: An inherent attack surface for indirect prompt injection exists because the skill reads and acts upon local source files. This is mitigated by: (1) Ingestion points: Processing .ts, .js, and .sol files during analysis and conversion; (2) Boundary markers: Phase-sequential checkpoints with mandatory human-in-the-loop review; (3) Capability inventory: File system edits and command execution; (4) Sanitization: Relies on user approval of all changes before they are committed to version control.
Audit Metadata