smart-contract-auditor
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches smart contract metadata, verified source code, and security intelligence from well-known third-party services including Sourcify, Blockscout, GoPlus Security, and 4byte.directory. These connections are legitimate and required for the skill's primary function of auditing blockchain contracts.
- [COMMAND_EXECUTION]: Executes local Python scripts to perform data parsing and static analysis. These scripts use standard Python libraries and do not involve the execution of arbitrary commands or untrusted external code.
- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it retrieves and analyzes untrusted smart contract source code from external APIs.
- Ingestion points: Verified source code is fetched from Sourcify and Blockscout across all analysis scripts.
- Boundary markers: The instructions do not implement explicit boundary markers or warnings to ignore instructions embedded within the analyzed contract code.
- Capability inventory: The skill uses Python scripts to perform network requests and process data. It does not have file-system write access or persistent storage capabilities.
- Sanitization: Scripts perform regex-based vulnerability scanning and signature decoding, which reduces the reliance on the agent's interpretation of the raw code.
Audit Metadata