bitflow-swap-aggregator
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill accesses local configuration and credential files within the
~/.aibtcdirectory to resolve signers. It supports encrypted keystores and session files, following the established security patterns of the AIBTC ecosystem. - [COMMAND_EXECUTION]: The skill prepares and broadcasts blockchain transactions. It mitigates risk by requiring a specific
--confirm=SWAPflag for execution and employing Stacks post-conditions (PostConditionMode.Deny) to ensure only intended asset transfers occur. - [EXTERNAL_DOWNLOADS]: The skill communicates with the Hiro API (
api.hiro.so) and Bitflow API (api.bitflowapis.finance). These are well-known service providers for Stacks blockchain data and DeFi routing. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from the Bitflow token registry and route quotes.
- Ingestion points: Fetches data from Bitflow and Hiro APIs in
bitflow-swap-aggregator.ts. - Boundary markers: Uses structured JSON communication and strictly defined TypeScript interfaces.
- Capability inventory: Smart contract calls via Stacks SDK.
- Sanitization: Uses atomic unit conversions and SDK-validated transaction structures.
- [DYNAMIC_EXECUTION]: Uses dynamic
import()statements for the Bitflow and Stacks SDKs. This is used for standard runtime dependency management and does not involve executing code from untrusted external sources.
Audit Metadata