virtual-solana-incubator
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill contains a preamble and telemetry script that manages usage statistics. It reads a local configuration file (
~/.superstack/config.json) and sends non-sensitive metadata (skill name, platform, session duration) to a remote endpoint hosted on Convex. This behavior is documented for the user, requires consent, and uses a well-known service, meeting standard safety criteria. - [PROMPT_INJECTION]: The skill's workflow involves the agent reviewing user-provided code exercises. This presents a potential surface for indirect prompt injection, as untrusted data is processed for technical feedback. However, this is an inherent part of the skill's mentoring purpose, and no sensitive capabilities are triggered by the analysis of this data.
- [EXTERNAL_DOWNLOADS]: The curriculum references established libraries and frameworks such as Anchor and LiteSVM. These are standard, well-known resources in the Solana development ecosystem and do not represent a security risk in this context.
Audit Metadata