dapp
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides templates for building applications that ingest data from the Stellar blockchain and user-provided form inputs, which are then used in transaction construction and signing.\n
- Ingestion points: User input fields for transaction details in
react.mdand contract results fetched from the RPC server indata-fetching.md.\n - Boundary markers: The provided code examples do not demonstrate the use of specific boundary markers or delimiters to isolate data from instructions when building transactions.\n
- Capability inventory: The skill enables transaction building, signing via browser wallets (Freighter, Wallets Kit), and submission to the network (
SKILL.md,react.md,smart-accounts.md).\n - Sanitization: Data validation is performed by the SDK's internal logic, but there is no explicit sanitization for external content displayed in the UI status messages.\n- [EXTERNAL_DOWNLOADS]: The skill fetches development libraries from the NPM and JSR package registries.\n
- Evidence: Installation of
@stellar/stellar-sdkand@creit-tech/stellar-wallets-kit.\n- [EXTERNAL_DOWNLOADS]: The instructions reference official repositories and documentation from the Stellar Development Foundation and OpenZeppelin.\n - Evidence: References to
stellar.github.ioandchannels.openzeppelin.com.
Audit Metadata