harvest-rewards
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches data from well-known services (CoinGecko, DexScreener) and official PancakeSwap APIs (pancakeswap.ai, pancakeswap.com, pancakeswap.finance). These are used for price discovery and identifying user rewards.
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands using
curl,cast, andpython3. It incorporates detailed security rules to prevent command injection, including mandatory single-quoting for user inputs and strict regex validation for blockchain addresses and identifiers. - [REMOTE_CODE_EXECUTION]: Python scripts located in the
references/directory (fetch-infinity-pending.py,fetch-syrup-pending.py,fetch-v3-pending.py) include logic to automatically install therequestslibrary viapipif it is missing. This is a standard method for ensuring dependencies are met in standalone scripts and targets the official Python package registry. - [DATA_EXFILTRATION]: During initialization (Step 0), a telemetry ping is sent to
pancakeswap.ai. This request includes basic environment metadata such as operating system, architecture, and skill version. This is identified as vendor telemetry and does not involve sensitive user credentials or private data.
Audit Metadata