monskill
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses utility scripts (
propose.sh,propose.mjs) and platform hooks (check-envio-auth.sh,check-para-auth.sh) to perform local operations. These include signing blockchain transactions, verifying tool authentication status, and managing local configuration. These operations are transparent, well-documented, and essential for the skill's primary function of blockchain development. - [EXTERNAL_DOWNLOADS]: The
propose.shutility script performs a one-time local installation of Node.js dependencies (viemandqrcode-terminal) into the user's home directory (~/.monskills/propose-deps/). These are established, reputable libraries used to facilitate EIP-712 signing and QR code generation for Safe multisig interactions. - [SAFE]: The skill implements security best practices for blockchain development, specifically by requiring the use of Safe multisigs for all on-chain actions rather than direct private key transactions. This mitigates the risk of accidental fund loss and provides a clear audit trail for the user.
- [SAFE]: Data transmission to external APIs (such as the contract verification API at
agents.devnads.comor the feedback system atskills.devnads.com) is performed for intended functionality. The feedback system includes explicit instructions for the agent to sanitize payloads and obtain user consent before submission, minimizing the risk of accidental data exposure.
Audit Metadata