evm-deployment
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes several command-line utilities including
forge,cast,cp, andbunto manage the smart contract lifecycle. These tools are used for compiling, deploying, interacting with blockchain RPCs, and copying deployment metadata to the SDK repository. - [DYNAMIC_EXECUTION]: Provides a transparent Python script snippet intended for local execution to parse
initCodefrom deployment logs. This utility assists in extracting constructor arguments necessary for verifying contracts created via factories (CREATE2). - [INDIRECT_PROMPT_INJECTION]: The skill's workflow is driven by data ingested from project files, which serves as a potential surface for indirect injection.
- Ingestion points: The agent reads protocol information from
package.jsonand deployment addresses/metadata from Foundry'srun-latest.jsonbroadcast files. - Boundary markers: Not explicitly defined, as the skill assumes these files are generated by the user's local build environment.
- Capability inventory: The skill has capabilities to execute shell commands and modify local files within the project structure.
- Sanitization: The automation relies on structured JSON data produced by standard development tools, minimizing the risk of arbitrary instruction execution.
Audit Metadata