radius-dev
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from blockchain logs and network APIs (Ingestion:
publicClient.getLogsinreferences/events-viem.md,transaction-costAPI inreferences/typescript-viem.md). This data influences transaction parameters and settlement logic (Capabilities:walletClient.sendTransaction,writeContract). While boundary markers are not explicitly defined in the provided code snippets, the skill includes logic for normalizing inputs and extracting revert reasons (Sanitization:normalizeChainId,extractRevertReasoninreferences/gotchas.md). This constitutes an indirect prompt injection surface. - [EXTERNAL_DOWNLOADS]: Recommends downloading the Foundry development toolchain from its official source at
foundry.paradigm.xyzand installing standard ecosystem packages from NPM. - [REMOTE_CODE_EXECUTION]: Provides instructions for installing the Foundry toolkit by piping a script from
foundry.paradigm.xyzinto a shell. This is the established installation method provided by the Paradigm team and is a standard tool in the EVM development ecosystem. - [COMMAND_EXECUTION]: Includes CLI commands for smart contract interactions and deployments using Foundry tools (
forge create,cast send). The skill correctly recommends passing sensitive private keys via environment variables or command-line flags rather than hardcoding them in scripts.
Audit Metadata