evm-atlas
Fail
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches blockchain data from official and well-known services, including Etherscan, Blockscout, and various bridge APIs (Across, Bungee, LI.FI, Socket, etc.). These connections are documented for their intended purpose of providing read-only blockchain evidence and use verified, official endpoints.
- [COMMAND_EXECUTION]: Local shell scripts and a Python utility (sweep-core.py) are used to perform calculations, validate API responses, and coordinate address sweeps. These scripts rely on standard system tools like curl, jq, and bc, and use Python standard libraries for data processing.
- [SAFE]: Secret management is correctly implemented using environment variables. The instructions explicitly prohibit the logging or echoing of API keys in output transcripts. Furthermore, the skill incorporates strict validation and sanity checks for all ingested blockchain data to mitigate potential injection risks from external sources.
Recommendations
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata