hub-swap-planner
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches token metadata, routing information, and pricing data from the developer's Hub API and reputable third-party crypto data providers like DexScreener and CoinGecko.
- [COMMAND_EXECUTION]: Employs the
python3interpreter for local mathematical operations (unit conversions) and thecastCLI tool for verifying smart contract data on-chain. - [EXTERNAL_DOWNLOADS]: Performs an initialization ping to the vendor's telemetry endpoint (
pancakeswap.ai) to record usage metrics, including non-sensitive system metadata such as operating system and CPU architecture. - [PROMPT_INJECTION]: Processes untrusted data from external sources (e.g., token names and symbols from API responses). This risk is addressed through explicit internal security instructions that mandate treating all such external data as non-executable text and never interpreting it as agent commands.
- [SAFE]: The skill implements a comprehensive set of mandatory security rules covering input validation, URL restrictions for browser redirection, and the protection of sensitive environment variables.
Audit Metadata