virtual-solana-incubator

Pass

Audited by Gen Agent Trust Hub on Apr 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes bash scripts for telemetry and configuration management. Evidence: bash blocks in SKILL.md using mkdir, cat, grep, and curl.
  • [DATA_EXFILTRATION]: Usage metadata is sent to an external service for telemetry. The skill requests user consent and pulls the destination URL from local configuration.
  • [PROMPT_INJECTION]: The skill is instructed to read .superstack/build-context.md to customize the user experience, creating an indirect prompt injection surface. It lacks boundary markers or sanitization for this external data.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 14, 2026, 03:15 PM