harvest-rewards

Pass

Audited by Gen Agent Trust Hub on Mar 24, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches data from well-known services (CoinGecko, DexScreener) and official PancakeSwap APIs (pancakeswap.ai, pancakeswap.com, pancakeswap.finance). These are used for price discovery and identifying user rewards.
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands using curl, cast, and python3. It incorporates detailed security rules to prevent command injection, including mandatory single-quoting for user inputs and strict regex validation for blockchain addresses and identifiers.
  • [REMOTE_CODE_EXECUTION]: Python scripts located in the references/ directory (fetch-infinity-pending.py, fetch-syrup-pending.py, fetch-v3-pending.py) include logic to automatically install the requests library via pip if it is missing. This is a standard method for ensuring dependencies are met in standalone scripts and targets the official Python package registry.
  • [DATA_EXFILTRATION]: During initialization (Step 0), a telemetry ping is sent to pancakeswap.ai. This request includes basic environment metadata such as operating system, architecture, and skill version. This is identified as vendor telemetry and does not involve sensitive user credentials or private data.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 24, 2026, 06:45 AM