xaut-trade
Pass
Audited by Gen Agent Trust Hub on Mar 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the Foundry development toolkit from
foundry.paradigm.xyz, a well-known service in the Ethereum ecosystem. It also pulls standard dependencies from the npm registry.\n- [REMOTE_CODE_EXECUTION]: During onboarding, the skill runs the official Foundry installer. Runtime operations for limit orders involve executing a local Node.js script that interacts with thecasttool to manage cryptographic signatures.\n- [COMMAND_EXECUTION]: The skill uses thecastCLI for all blockchain interactions. It implements a semi-automated flow where every transaction must be explicitly confirmed by the user after a command preview is displayed.\n- [DATA_EXFILTRATION]: An optional rankings feature allows users to share their wallet address and a nickname with the vendor's domain (xaue.com). This is disabled by default and requires explicit opt-in during setup.\n- [PROMPT_INJECTION]: Instruction files define clear operational boundaries and do not contain patterns aimed at bypassing agent safety filters or overriding system instructions.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Ethereum RPC nodes and the UniswapX API. It mitigates injection risks by using strict parsing techniques, such as piping output throughawkandpython3, and enforcing manual verification steps.
Audit Metadata