moonpay-swap-tokens
Fail
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's primary logic involves building unsigned transactions via the domain
swaps.xyz. Automated security scanners have explicitly flagged this domain as malicious and blacklisted. Because the transaction building process is outsourced to this untrusted remote service, there is a significant risk that the service could return manipulated transaction data designed to drain user wallets or redirect funds to an attacker upon signing and broadcasting. - [COMMAND_EXECUTION]: The skill facilitates the execution of local shell commands via the
mpCLI utility. These commands incorporate data and parameters derived from the external, blacklistedswaps.xyzendpoint. The execution of financial operations based on data from a known malicious source constitutes a high-risk activity.
Recommendations
- AI detected serious security threats
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata