swap-build
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Bash shell commands to execute
curlPOST requests for building swap transactions through the KyberSwap Aggregator API. It also uses the systemdatecommand to generate accurate Unix timestamps for transaction deadlines. - [EXTERNAL_DOWNLOADS]: The skill retrieves token metadata, price routes, and safety info from official KyberSwap subdomains and CoinGecko. These resources are well-known or vendor-owned services necessary for the skill's primary function.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied addresses and token identifiers which are interpolated into API requests and transaction calldata. To mitigate risks, the skill implements mandatory user confirmation steps, strict validation for wallet addresses, and automated safety checks for malicious token features like honeypots.
Audit Metadata