deploying-contracts-on-abstract

Warn

Audited by Socket on Mar 7, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

Overall, the skill is coherently aligned with its stated purpose (deploying/verifying Abstract contracts with Foundry/Hardhat). However, it contains a high-risk, unverifiable installation pathway (curl ... | bash) from an external source and explicit handling of credentials (ABSCAN_API_KEY, private keys) that can be exposed through logs or misconfiguration. This combination yields elevated security risk. It should be considered SUSPICIOUS/HIGH-RISK until the install step is replaced with a verified, pinned, and signed installer from an official registry, and credentials are clearly scoped and protected (e.g., via dedicated secret management with minimal exposure).

Confidence: 65%Severity: 80%
Audit Metadata
Analyzed At
Mar 7, 2026, 09:01 AM
Package URL
pkg:socket/skills-sh/Abstract-Foundation%2Fabstract-skills%2Fdeploying-contracts-on-abstract%2F@8f9147b5465f06da582697365d873cff99fe06ff