setup-sui-contracts

Pass

Audited by Gen Agent Trust Hub on Jul 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Retrieves project architecture, package catalogs, and AI discovery metadata (llms.txt) from the official OpenZeppelin GitHub repository.
  • [EXTERNAL_DOWNLOADS]: Installs the prettier and @mysten/prettier-plugin-move packages from the NPM registry to support standardized code formatting for Move files.
  • [COMMAND_EXECUTION]: Employs standard developer tools including the sui CLI for building and testing, and the gh CLI for repository inspection.
  • [PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by instructing the agent to ingest and follow instructions from remote discovery files and READMEs.
  • Ingestion points: https://raw.githubusercontent.com/OpenZeppelin/contracts-sui/main/llms.txt and referenced package README files.
  • Boundary markers: None explicitly specified for the remote content.
  • Capability inventory: Shell execution for sui, npm, and gh commands across all project setup scripts.
  • Sanitization: Relies on the Move compiler's validation and the Move Registry's resolution mechanisms.
  • Assessment: The risk is mitigated as the ingestion sources are restricted to official vendor-controlled repositories.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 16, 2026, 03:23 PM
Security Audit — agent-trust-hub — setup-sui-contracts