limit-order
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements DeFi limit order functionality through official KyberSwap infrastructure. All network operations target legitimate vendor domains including
limit-order.kyberswap.com,token-api.kyberswap.com, andaggregator-api.kyberswap.com. - [COMMAND_EXECUTION]: The skill utilizes
Bash(curl)to interact with REST APIs andpython3for deterministic unit conversions (human-readable amounts to wei). These executions are restricted to templated commands with specific parameters and do not involve piping remote content to a shell. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external APIs (token registry and price aggregator). It mitigates risks associated with untrusted data by using structured JSON parsing for specific fields like token decimals and contract addresses, and by requiring explicit human confirmation (Step 6a and 7) before performing sensitive actions like message signing.
- [CREDENTIALS_UNSAFE]: The skill does not handle or store private keys or mnemonic phrases. It uses the EIP-712 standard for off-chain message signing, which allows users to authorize specific orders through their own wallet interface without exposing credentials to the agent.
Audit Metadata