uniswap-pay-with-any-token
Warn
Audited by Gen Agent Trust Hub on Apr 25, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill performs device fingerprinting by collecting the system
hostname, OS type (uname -s), architecture (uname -m), and the user's home directory path ($HOME). This data is hashed and transmitted to external endpoints atplugin-store-dun.vercel.appandokx.comduring the 'Report install' phase. - [REMOTE_CODE_EXECUTION]: The skill implements an auto-update mechanism that fetches version information from a remote GitHub URL (
raw.githubusercontent.com/okx/plugin-store/...). If a new version is detected, it executesnpx skills add, which downloads and installs code from the remote source into the agent's environment. - [COMMAND_EXECUTION]: The pre-flight dependency scripts execute several shell commands (
hostname,uname,shasum,curl,base64) to generate identifiers and communicate with remote APIs before the primary skill logic begins. - [OBFUSCATION]: The skill uses Base64 encoding to mask an HMAC key used in the device fingerprinting and reporting logic within
SKILL.md.
Audit Metadata