hodlmm-flow
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches transaction data and pool information from the Hiro API (
api.hiro.so) and Bitflow's official APIs (bitflowapis.finance). These are legitimate data sources required for the skill's purpose and are recognized as well-known or vendor-owned infrastructure. - [COMMAND_EXECUTION]: The tool is a CLI application written in TypeScript for the Bun runtime. It performs structured data analysis rather than executing arbitrary shell commands.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from blockchain transactions. While this data is untrusted, the skill strictly parses specific financial values and contract events, outputting a structured JSON safety verdict. This reduces the risk of malicious transaction metadata influencing the agent's behavior.
- [CREDENTIALS_UNSAFE]: The skill supports an optional user-provided Hiro API key for higher rate limits. It does not contain hardcoded secrets and includes guardrails to prevent the agent from leaking provided keys in logs or outputs.
- [PERSISTENCE]: A local cache directory (
~/.hodlmm-flow-cache) is used to store API results with a 5-minute time-to-live. This is a standard optimization to prevent redundant network requests and does not serve as a malicious persistence mechanism.
Audit Metadata