bsc-contract-audit
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches audit data and verification status from several well-known services including Sourcify, Etherscan, GoPlus, and DexScreener. It also utilizes Binance's official Web3 security audit API.
- [COMMAND_EXECUTION]: The skill uses local shell and Python scripts (
scripts/binance_audit.shandscripts/rpc.py) to interact with blockchain RPC nodes and APIs. These scripts use standard libraries and do not perform unsafe command execution or dynamic code evaluation. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill requires an RPC URL and an optional Etherscan API key to function. These are standard requirements for blockchain analysis tools and are handled as environment variables. Network requests are limited to recognized auditing and infrastructure services.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from on-chain sources (contract names, symbols, and bytecode) and external API responses. It mitigates injection risks by using structured data formats (JSON) and explicit hex-decoding for blockchain data rather than raw text interpolation into prompts.
- [OBFUSCATION]: The tool includes a manual implementation of the Keccak-256 (SHA-3) hashing algorithm in Python to remain dependency-free. This is standard cryptographic code for Ethereum-compatible chains and is not an attempt at obfuscation.
Audit Metadata