solidity-development
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze and generate Solidity code based on user-provided descriptions and contract source. This creates a surface for indirect prompt injection if the code provided for analysis contains malicious instructions embedded in comments or metadata.
- Ingestion points: User-provided task descriptions via the CLI invocation (references/GUIDE.md).
- Boundary markers: None identified within the instructional content.
- Capability inventory: The skill is primarily instructional and facilitates standard local development tool usage.
- Sanitization: None present; functionality relies on the platform's underlying model guardrails.
- [COMMAND_EXECUTION]: The documentation provides examples for using standard industry command-line tools such as Foundry (forge) for compiling, testing, and checking contract sizes. These commands are intended for local development workflows and do not involve remote code execution from untrusted sources.
- [SAFE]: The provided validation script ('scripts/validate.py') and pattern documentation correctly utilize 'yaml.safe_load()' for processing configuration files, preventing potential YAML deserialization vulnerabilities.
Audit Metadata