swap-build

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Bash shell commands to execute curl POST requests for building swap transactions through the KyberSwap Aggregator API. It also uses the system date command to generate accurate Unix timestamps for transaction deadlines.
  • [EXTERNAL_DOWNLOADS]: The skill retrieves token metadata, price routes, and safety info from official KyberSwap subdomains and CoinGecko. These resources are well-known or vendor-owned services necessary for the skill's primary function.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied addresses and token identifiers which are interpolated into API requests and transaction calldata. To mitigate risks, the skill implements mandatory user confirmation steps, strict validation for wallet addresses, and automated safety checks for malicious token features like honeypots.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 11:37 PM