jingswap-v2
Fail
Audited by Snyk on Oct 1, 2026
Risk Level: HIGH
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.70). The skill makes runtime HTTP requests to an arbitrary Vercel backend (
https://faktory-dao-backend.vercel.app) to fetch auction state, prices, and validation data, constituting an unverified remote operational dependency under weak/unknown provenance.
HIGH W008: Secret detected in skill content (API keys, tokens, passwords).
- Secret detected (high risk: 1.00). The string
jc_b058d7f2e0976bd4ee34be3e5c7ba7ebe45289c55d3f5e45f666ebc14b7ebfd0found on line 30 ofjingswap-v2.tsis a hardcoded API key fallback value (JINGSWAP_API_KEY). It is a high-entropy hex string providing access to the Jingswap API service.
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill documentation explicitly defines a DeFi limit-price auction protocol on the Stacks blockchain (Jingswap V2) with specific functions for depositing cryptocurrency assets (
deposit-stx,deposit-sbtc), managing liquidity/limit orders, and executing decentralized financial transactions and swaps (close-and-settle). This represents direct cryptocurrency and asset trading/financial execution capability.
Issues (3)
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
W008
HIGHSecret detected in skill content (API keys, tokens, passwords).
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata