bitflow-hodlmm-withdraw

Pass

Audited by Gen Agent Trust Hub on Apr 30, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides a primitive for withdrawing liquidity from Bitflow HODLMM bins. It includes robust guardrails such as mandatory confirmation via the --confirm=EXIT flag and pre-transaction checks for gas and pending mempool state.
  • [COMMAND_EXECUTION]: Shell execution is limited to transaction signing and broadcasting using official Stacks blockchain libraries. All sensitive operations are preceded by state validation to ensure funds are not moved under invalid conditions.
  • [EXTERNAL_DOWNLOADS]: The skill fetches necessary pool and blockchain state from official Bitflow (bitflowapis.finance) and Hiro (api.hiro.so) APIs. These are well-known and expected services for the Stacks ecosystem.
  • [CREDENTIALS_UNSAFE]: Wallet credentials are handled through environment variables and local encrypted storage in the ~/.aibtc directory. The code follows the AIBTC security model, which prefers active sessions and includes explicit logic to prevent the logging or printing of sensitive key material.
  • [DATA_EXFILTRATION]: No unauthorized network operations or exfiltration patterns were detected. Network activity is limited to retrieving DeFi metadata and broadcasting transactions.
  • [PROMPT_INJECTION]: Instructions in SKILL.md and AGENT.md focus on operational safety and do not attempt to bypass agent guardrails or override system safety settings.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 30, 2026, 02:24 AM