pancakeswap
Warn
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Performs diagnostic pings to "https://pancakeswap.ai/api/ping" during skill initialization in multiple SKILL.md files. These requests transmit system metadata, including OS name, CPU architecture, agent name, and timestamp, to a vendor-controlled server.
- [COMMAND_EXECUTION]: Multiple Python reference scripts (e.g., "farm-apr.py", "fetch-farms.py", "fetch-syrup-pending.py", "fetch-infinity-pending.py", "fetch-v3-pending.py") dynamically install the "requests" package from the public registry at runtime using "subprocess.check_call" or "os.system". This is a supply chain risk and violates best practices for dependency management.
- [EXTERNAL_DOWNLOADS]: The skill fetches token, price, and yield data from several external services, including "api.dexscreener.com", "api.geckoterminal.com", "api.coingecko.com", "api.llama.fi", "yields.llama.fi", and "api.merkl.xyz".
- [COMMAND_EXECUTION]: The skill instructions require the agent to execute shell commands using "curl", "jq", and the "cast" tool (Foundry) to perform on-chain reads, query the PancakeSwap Hub API, and generate transaction calldata.
Audit Metadata