dca
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
bun addto install required dependencies during the initialization phase via theinstall-packscommand. - [EXTERNAL_DOWNLOADS]: The skill downloads official blockchain libraries from NPM registries and interacts with well-known infrastructure providers in the Stacks ecosystem (Hiro API at api.hiro.so and Bitflow API at bitflowapis.finance).
- [CREDENTIALS_UNSAFE]: The skill handles sensitive wallet credentials but implements mitigations by encouraging the use of environment variables instead of CLI flags to prevent password exposure in process lists (
ps aux). It uses a local encrypted keystore for mnemonic storage. - [DATA_EXPOSURE]: The skill reads wallet and plan configuration files from the local filesystem (
~/.aibtc/). Access is restricted to these specific paths necessary for state management and transaction signing.
Audit Metadata