bingx-swap-ws-account
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill communicates exclusively with the vendor's official infrastructure at bingx.com and bingx-api.com for WebSocket streams and Listen Key management.
- [SAFE]: The AI agent is explicitly restricted by mandatory 'CRITICAL RULES' to 'GET-only' execution, which prevents it from performing sensitive account operations like generating or deleting Listen Keys.
- [SAFE]: The skill implements a strong privacy boundary by forbidding the agent from returning raw code or API calls to the user, ensuring that implementation details and authentication logic remain internal.
- [SAFE]: The provided TypeScript helper logic uses industry-standard libraries (pako for GZIP, crypto for HMAC-SHA256) for data processing and signature generation.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted real-time data from a WebSocket stream (ACCOUNT_UPDATE, ORDER_TRADE_UPDATE). However, the risk is mitigated because the agent's capabilities are restricted to read-only GET requests and it is instructed to only provide natural-language summaries of the data.
Audit Metadata