hermetica-yield-rotator

Pass

Audited by Gen Agent Trust Hub on May 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script generates and outputs Model Context Protocol (MCP) commands such as call_contract, bitflow_swap, and bitflow_hodlmm_add_liquidity. These commands are not executed by the script itself but are passed to the agent's execution environment. The parameters for these commands, including wallet addresses and transaction amounts, are strictly validated against regex patterns to prevent injection.
  • [EXTERNAL_DOWNLOADS]: The skill performs HTTP GET and POST requests to api.mainnet.hiro.so and bff.bitflowapis.finance. These are well-known services (Hiro and Bitflow) essential for retrieving Stacks blockchain state and DeFi pool metrics respectively. The logic includes timeouts and abort controllers to prevent hanging processes.
  • [DATA_EXFILTRATION]: While the skill performs network operations, there is no evidence of sensitive data being exfiltrated. The skill only sends public Stacks addresses to retrieve balances and fetches public market data. It manages a local state file at ~/.hermetica-yield-rotator-state.json to track protocol exchange rates for APY calculation, which does not contain credentials or sensitive secrets.
Audit Metadata
Risk Level
SAFE
Analyzed
May 2, 2026, 10:57 AM