smart-contracts
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill serves as a high-quality educational resource, providing official documentation, best practices, and security checklists for the Stellar ecosystem.
- [INDIRECT_PROMPT_INJECTION]: The skill enables an agent to process user-supplied contract code and development tasks, which presents an inherent surface for indirect prompt injection.
- Ingestion points: User-provided Rust smart contract source code, project metadata, and developer task descriptions.
- Boundary markers: The instructions do not define explicit delimiters or security markers for distinguishing user-provided data from agent instructions during code analysis.
- Capability inventory: The skill guides the agent to perform actions such as
stellar contract build,deploy, andinvoke, which involves executing shell commands and interacting with the file system. - Sanitization: There is no requirement for the agent to sanitize or validate the integrity of user-supplied code before processing it with development tools.
- [EXTERNAL_DOWNLOADS]: The skill references several external resources and tools for the Stellar ecosystem. These include official GitHub repositories for
stellar-cliandsoroban-sdk, as well as well-known security tools from organizations like OpenZeppelin and CoinFabrik. All referenced domains (e.g., stellar.org, lab.stellar.org, crates.io, docs.rs) are official or standard developer services.
Audit Metadata