upgrade-solidity-contracts
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a pre-formatted Node.js command string for users to execute via Bash to compute ERC-7201 storage locations. While the code is visible, executing arbitrary logic to compute storage slots is a capability that could be misused if modified.
- [EXTERNAL_DOWNLOADS]: Documents the installation of dependencies from trusted sources (foundry-rs and OpenZeppelin) using
forge install. Per [TRUST-SCOPE-RULE], these are safe sources and do not contribute to a higher severity verdict. - [INDIRECT_PROMPT_INJECTION]: As a tool that generates Solidity source code and processes developer-defined namespace IDs, it has a vulnerability surface for indirect prompt injection if the inputs (like the namespace string) are sourced from untrusted external data.
Audit Metadata