Security audit
Security checks for vulnerabilities and agentic risk
This Aptos deployment guide is mostly coherent, but it includes auto-confirm commands for mainnet deployments and upgrades that can submit high-impact blockchain transactions without an interactive confirmation.
Review this skill before installing if you may use it for mainnet. Do not let an agent run the `--assume-yes` mainnet deploy or upgrade commands unless you have independently checked the network, account, object address, code diff, compatibility, gas cost, and transaction impact. The skill is not malicious, but its safest use requires explicit human confirmation for production transactions.
The manifest description says the skill triggers on phrases including 'how to deploy' and 'deployment checklist', which are broad natural-language phrases that can appear in many ordinary conversations. The trigger list does not include exclusion conditions or context limits, so the activation scope is wider than necessary for a deployment-specific skill.
The skill recommends --assume-yes for a mainnet deployment flow, which suppresses interactive confirmation for a real-value blockchain transaction. In an agent-driven context, this increases the risk of unintended or insufficiently reviewed deployments, including wrong-network, wrong-address, or unexpected-cost transactions becoming irreversible on mainnet.
# 1. Gas confirmation: Review gas costs
# 2. Object address: Note the object address for future reference
# OR use --assume-yes to auto-confirm (only if you're confident)
aptos move deploy-object \
--address-name my_addr \
--profile default \
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Create deployment record:
# Deployment Record
The upgrade example includes an auto-confirm path for upgrade-object, which can cause an irreversible contract upgrade to proceed without an explicit human checkpoint. In a smart-contract deployment skill, bypassing prompts is especially risky because upgrades may alter production logic, break compatibility, or incur real financial and operational consequences.
--object-address <object_address_from_initial_deploy> \
--profile mainnet
# Upgrade with auto-confirm
aptos move upgrade-object \
--address-name my_addr \
--object-address <object_address> \
No suspicious patterns detected.