evm-deployment

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes several command-line utilities including forge, cast, cp, and bun to manage the smart contract lifecycle. These tools are used for compiling, deploying, interacting with blockchain RPCs, and copying deployment metadata to the SDK repository.
  • [DYNAMIC_EXECUTION]: Provides a transparent Python script snippet intended for local execution to parse initCode from deployment logs. This utility assists in extracting constructor arguments necessary for verifying contracts created via factories (CREATE2).
  • [INDIRECT_PROMPT_INJECTION]: The skill's workflow is driven by data ingested from project files, which serves as a potential surface for indirect injection.
  • Ingestion points: The agent reads protocol information from package.json and deployment addresses/metadata from Foundry's run-latest.json broadcast files.
  • Boundary markers: Not explicitly defined, as the skill assumes these files are generated by the user's local build environment.
  • Capability inventory: The skill has capabilities to execute shell commands and modify local files within the project structure.
  • Sanitization: The automation relies on structured JSON data produced by standard development tools, minimizing the risk of arbitrary instruction execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 02:12 PM