defillama-openapi-skill
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed for read-only access to public DefiLlama analytics via the
uxccommand-line tool. - [EXTERNAL_DOWNLOADS]: Fetches a curated OpenAPI schema from the vendor's official GitHub repository (
github.com/holon-run/uxc). This is a legitimate configuration download from the skill author. - [COMMAND_EXECUTION]: Uses standard shell commands like
command -vanduxc linkto configure local CLI aliases. These are part of the intended setup workflow. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from
api.llama.fi. However, the scope is restricted to read-only analytics, and the instructions include guardrails to parse specific JSON fields, minimizing the risk of processing malicious instructions embedded in API responses. - [DATA_EXFILTRATION]: No sensitive file access or unauthorized network operations were detected. The network traffic is limited to the official
api.llama.fiendpoint.
Audit Metadata