debridge
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation and configuration files (SKILL.md and Cargo.toml) reference the official deBridge Solana SDK repository on GitHub (github.com/debridge-finance/debridge-solana-sdk). This is the standard distribution method for the protocol's developer tools.
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge between agent instructions and blockchain transactions, creating a surface where untrusted data could influence transaction parameters.
- Ingestion points: External parameters including target_chain_id, receiver, and message data processed by the send_message, send_to_evm, and send_with_external_call functions in SKILL.md and the example programs.
- Boundary markers: The SDK relies on Anchor's framework validation and internal protocol checks, such as ValidatedExecuteExtCallIx for claim verification.
- Capability inventory: The skill utilizes Solana Cross-Program Invocation (CPI) capabilities via invoke_debridge_send and related functions to commit state changes and fund transfers to the blockchain.
- Sanitization: The provided examples include input validation logic, such as address length verification and Keccak256 hashing for data integrity.
- [DYNAMIC_EXECUTION]: The skill facilitates the construction and execution of arbitrary smart contract calls on destination blockchains (e.g., Ethereum or Polygon). This capability is the core intended functionality of the deBridge SDK for supporting cross-chain DeFi, governance, and state synchronization.
Audit Metadata