one-click-token-launch

Pass

Audited by Gen Agent Trust Hub on May 8, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes the onchainos CLI tool to perform wallet operations and fetch market data. These executions are performed using argument lists with subprocess.run and asyncio.create_subprocess_exec, avoiding shell invocation and mitigating command injection risks.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with various third-party APIs related to Solana and BSC launchpads, including PumpPortal, Bags.fm, and Moonit, as well as IPFS services like Pinata. These connections are necessary for its documented functionality and target appropriate service domains.
  • [DATA_EXFILTRATION]: No sensitive data exposure was identified. The skill utilizes a secure signing flow via a Trusted Execution Environment (TEE), meaning private keys are not stored or handled within the skill's code. Ephemeral keys generated for token minting are used according to protocol requirements.
  • [SAFE]: The code is well-structured, follows security best practices (such as local dashboard path filtering), and includes explicit risk warnings and confirmation steps for irreversible actions.
Audit Metadata
Risk Level
SAFE
Analyzed
May 8, 2026, 03:41 PM