virtual-solana-incubator
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes bash scripts for telemetry and configuration management. Evidence: bash blocks in
SKILL.mdusingmkdir,cat,grep, andcurl. - [DATA_EXFILTRATION]: Usage metadata is sent to an external service for telemetry. The skill requests user consent and pulls the destination URL from local configuration.
- [PROMPT_INJECTION]: The skill is instructed to read
.superstack/build-context.mdto customize the user experience, creating an indirect prompt injection surface. It lacks boundary markers or sanitization for this external data.
Audit Metadata