@349/lighter-dex

Pass

Audited by Gen Agent Trust Hub on Mar 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the lighter-sdk Python package. It performs network operations to mainnet.zklighter.elliot.ai and testnet.zklighter.elliot.ai to retrieve market data and execute trades. These endpoints represent the official infrastructure for the Lighter DEX service.
  • [CREDENTIALS_UNSAFE]: The skill manages highly sensitive Lighter API private keys. It includes helper scripts like generate_keys.py and find_account_index.py to facilitate setup. The documentation consistently follows security best practices by advising users to store these credentials in environment variables rather than hardcoding them in scripts.
  • [COMMAND_EXECUTION]: The skill contains several executable Python scripts in the scripts/ directory designed for user-initiated account configuration, market lookup, and risk calculation. These scripts operate as intended for the primary purpose of the skill.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: Market data, funding rates, and account balances are ingested from the Lighter DEX API in tools.py.
  • Boundary markers: The skill does not use explicit boundary markers when passing API-retrieved data to the agent's context.
  • Capability inventory: The skill possesses significant capabilities, including placing market/limit orders, modifying leverage, and canceling orders in tools.py.
  • Sanitization: The skill sanitizes incoming API data by casting values to specific numeric types (floats and integers) before returning them to the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 18, 2026, 03:10 AM
Security Audit — agent-trust-hub — @349/lighter-dex