cli-cast
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches Ethereum gas market data from the Rabby API (api.rabby.io) using a bundled shell script. This is a well-known service in the blockchain ecosystem and is used here for legitimate fee estimation.\n- [COMMAND_EXECUTION]: The skill uses the Foundry cast CLI to prepare, sign, and broadcast transactions. It also executes a local bash script to interact with the Rabby API.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection due to its ingestion of external data.\n
- Ingestion points: The skill ingests blockchain state data from the evm-atlas skill and gas price quotes from the Rabby API via scripts/rabby-slow-gas.sh.\n
- Boundary markers: No explicit prompt delimiters or ignore instructions warnings are specified for the ingested external data.\n
- Capability inventory: The skill can execute complex shell commands for transaction broadcasting and can write temporary files for message signing.\n
- Sanitization: The rabby-slow-gas.sh script uses jq to strictly validate the structure and content of the JSON response from the Rabby API.
Audit Metadata