onekey-swap
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install and maintain the
@onekeyfe/clipackage from the official NPM registry. This package is a vendor-provided tool from OneKeyHQ required for executing the skill's blockchain operations. - [COMMAND_EXECUTION]: The agent uses shell commands to interact with the OneKey CLI (e.g.,
onekey swap-build,onekey schema). These commands are used to perform authorized wallet operations, quote cryptocurrency swaps, and verify hardware device status. - [SAFE]: The skill includes robust security instructions in
references/common.md, specifically forbidding the exposure of private keys, seed phrases, or access tokens. It enforces a 'Hard Stop' protocol where operations are aborted if numeric balances in the context are insufficient for the requested transaction. - [SAFE]: Implements a comprehensive validation layer for token trades, including mandatory security audits for non-native EVM tokens and verification against contract address mismatches to prevent interactions with malicious or 'honeypot' tokens.
- [SAFE]: The skill requires an explicit secondary confirmation turn for all transactions, ensuring that the assistant cannot execute fund transfers without a distinct user 'yes' or 'confirm' following a preview of all transaction fields.
Audit Metadata