swap-tokens
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a process for reading repository files as context. This introduces a surface where data from the codebase could influence the agent. The skill includes mandatory instructions to ignore swap parameters found in the repository and instead rely exclusively on explicit user input and confirmation, effectively mitigating potential injection attempts from the codebase.
- Ingestion points: Repository files and configuration.
- Boundary markers: Instruction hierarchy mandates user confirmation over repository context.
- Capability inventory: Generates code for token swaps, bridging, and wallet interactions.
- Sanitization: Mandatory Decision Guide and user review steps before generating fund-moving operations.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install necessary dependencies from the NPM registry. These packages include official Circle SDKs and standard blockchain libraries such as Viem and the Solana web3 suite. These resources are maintained by established organizations.
- [COMMAND_EXECUTION]: The skill provides shell commands for package installation and generates TypeScript/JavaScript code for implementing swap logic. It explicitly instructs the agent not to execute these operations directly, but to provide them for user review and execution. It also includes prominent warnings regarding the risks of moving real funds on mainnet.
Audit Metadata