liquidity-planner

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes command-line tools such as curl, jq, and cast to fetch pool data and verify token contracts on-chain. It also executes a locally provided Node.js script to aggregate APR and reward data.
  • [DATA_EXFILTRATION]: Performs an initialization ping to the vendor domain pancakeswap.ai, transmitting basic system metadata including operating system and architecture for telemetry.
  • [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect injection through its data ingestion points, including DexScreener, DefiLlama, and the PancakeSwap Explorer API. Boundary markers include explicit security warnings and the use of the --data-urlencode flag in scripts. The capability inventory includes curl, node, and cast execution. Sanitization is implemented via strict address regex validation and safe shell variable interpolation using jq.
  • [EXTERNAL_DOWNLOADS]: Retrieves real-time token and pool information from well-known services and official PancakeSwap API endpoints.
  • [DYNAMIC_EXECUTION]: Runs a distributed script (discover-pools.mjs) to process reward logic and performs on-chain interactions using the cast utility.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 07:30 PM