SunPerp Perpetual Futures Trading
Fail
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: CRITICALCREDENTIALS_UNSAFEDATA_EXFILTRATION
Full Analysis
- [DATA_EXFILTRATION]: Automated security scans have flagged the primary API domain,
https://api.sunx.io, as a blacklisted malicious URL. This domain is the central endpoint for all market data, account management, and trading operations, posing a severe risk of data exfiltration or unauthorized fund manipulation. - [CREDENTIALS_UNSAFE]: The skill requires the user to provide a
TRON_PRIVATE_KEYas an environment variable to authorize withdrawals. Storing and processing plaintext private keys in an AI agent's environment is an extremely unsafe practice that grants the skill full control over the user's on-chain assets. - [DATA_EXFILTRATION]: In
scripts/wallet.js, the skill defaults to using a non-standard, vendor-controlled RPC gateway (https://hptg.bankofai.io) for signing withdrawal-related messages. Routing blockchain traffic through a private proxy instead of official nodes increases the risk of transaction monitoring or interception. - [DATA_EXFILTRATION]: The
resources/sunperp_config.jsonfile has been flagged by scanners as malicious. This file contains the foundational routing and safety parameters for the skill; if compromised, it could be used to redirect API calls to attacker-controlled infrastructure or bypass configured safety locks.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata