swap-planner

Pass

Audited by Gen Agent Trust Hub on Mar 11, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Bash(curl), Bash(jq), and Bash(cast) for legitimate blockchain data retrieval and contract verification. Security is maintained through a mandatory input validation step (Step 3) that requires token addresses to match a strict hex regex (^0x[a-fA-F0-9]{40}$) and amounts to be numeric before execution.
  • [EXTERNAL_DOWNLOADS]: Fetches real-time market data (prices, liquidity, volume) from well-known services DexScreener (api.dexscreener.com) and DefiLlama (coins.llama.fi). These are standard, unauthenticated APIs used for the skill's primary purpose of swap planning.
  • [PROMPT_INJECTION]: No evidence of prompt injection or behavior override attempts. The instructions focus on structured workflows and user safety.
  • [DATA_EXFILTRATION]: No sensitive file access or unauthorized data transmission detected. Network operations are limited to fetching public market data and opening official Uniswap deep links.
  • [SAFE]: The skill implements a 'Risk Assessment' framework that explicitly warns users about market cap, liquidity, and contract age risks before performing transactions. It also includes fallback mechanisms for headless environments where browser opening might fail.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 11, 2026, 06:07 PM