deploying-contracts-on-base
Pass
Audited by Gen Agent Trust Hub on Feb 25, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_EXFILTRATION]: The skill provides robust guidance on managing sensitive data. It explicitly instructs users and the agent to avoid hardcoding API keys or private keys and warns against committing
.envfiles to version control. All secret inputs use clear placeholders. - [EXTERNAL_DOWNLOADS]: The skill references the installation of the
@coinbase/cdp-sdkvia NPM. This is an official package from a well-known, trusted organization (Coinbase) and is necessary for the skill's stated functionality. - [COMMAND_EXECUTION]: The skill templates several shell commands using the
forgetool. Importantly, it includes a dedicated 'Input Validation' section that provides strict regular expression patterns to sanitize user inputs (e.g., contract paths, RPC URLs) before they are used in commands, effectively mitigating shell injection risks. - [PROMPT_INJECTION]: The content contains 'Agent behavior' blocks which serve as legitimate instructional boundaries for the AI, rather than attempts to bypass safety filters or override system instructions.
- [SAFE]: The skill is well-structured, follows security best practices for blockchain deployment, and originates from a trusted source.
Audit Metadata