pyth-evm
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill is a set of developer templates and educational guides for Pyth Oracle integration. It includes critical security advice, such as avoiding standalone price updates to prevent sandwich attacks and implementing confidence interval checks to ensure data reliability during market volatility.- [EXTERNAL_DOWNLOADS]: The skill references and downloads dependencies from official, well-known organizations:
- Solidity SDK:
pyth-network/pyth-crosschainfrom GitHub via Foundry. - Node.js packages:
@pythnetwork/hermes-clientand@pythnetwork/express-relay-jsfrom the official NPM registry.- [DATA_EXFILTRATION]: The examples demonstrate network communication with official Pyth Network infrastructure: - Price updates are fetched from the Hermes API at
https://hermes.pyth.network. - MEV-protected liquidation auctions use
https://per-arbitrum.dourolabs.app, which is the official endpoint for Douro Labs (Pyth's infrastructure provider). - These operations are required for the oracle's pull-based model and do not involve sensitive user data exfiltration.- [COMMAND_EXECUTION]: Provides standard command-line examples for blockchain development, including
forge createfor contract deployment andnpm installfor package management. The use of environment variables likePRIVATE_KEYfor transaction signing is standard developer practice and no hardcoded credentials were found.
Audit Metadata