fizz-convert
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it reads and processes natural language descriptions from
PROPERTIES.mdto generate executable Solidity code. - Ingestion points: Reads from
PROPERTIES.mdin the project root. - Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the property descriptions.
- Capability inventory: The skill has the capability to write to multiple Solidity files (
Properties.sol,Base.sol,Snapshots.sol, and handler files) and execute shell commands (forge build). - Sanitization: No explicit sanitization or validation of the input text is performed before it is used to generate code.
- [COMMAND_EXECUTION]: The skill executes the
forgeCLI tool (Foundry) to compile the generated smart contracts. - Evidence:
forge buildandFOUNDRY_PROFILE=fuzz forge buildare called in the Step 5 build phase.
Audit Metadata