v4-hook-generator
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-defined goals and configurations to scaffold smart contract code, creating a surface where malicious user input could potentially influence the generated Solidity logic.
- Ingestion points: User requirements for hook functionality and permissions gathered in 'Step 1: Gather Requirements' in SKILL.md.
- Boundary markers: No explicit delimiters or boundary markers are defined in the instructions to separate user input from agent prompts.
- Capability inventory: The skill is authorized to use Bash for file operations and WebFetch, and it generates code for financial contracts.
- Sanitization: The skill relies on the OpenZeppelin MCP tool and the recommended use of the 'v4-security-foundations' skill for auditing, rather than providing internal sanitization of inputs.
Audit Metadata