starchild-swap-and-bridge

Pass

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches data and transaction calldata from the WOOFi API (sapi.woofi.com) and the LayerZero Value Transfer API (transfer.layerzero-api.com). These are well-known services in the decentralized finance sector.
  • [COMMAND_EXECUTION]: Utilizes the curl binary to perform quote requests to WOOFi's public endpoints. This is a standard and expected method for API interaction in this context.
  • [DATA_EXFILTRATION]: Performs network operations to external DeFi APIs. All calls are routed to official protocol endpoints or through a local proxy (core.http_client). The skill does not access or transmit sensitive local files or credentials.
  • [SAFE]: The skill incorporates significant security guardrails for financial operations:
  • Approval Sequencing: It mandates re-quoting after a token approval is confirmed to prevent the use of stale price data or invalid calldata.
  • Human-in-the-Loop: Explicitly requires the agent to decode and present critical transaction details (spender address, amount, destination chain) for user review before signing any transaction.
  • Validation: Implements two-stage validation for token balances and gas availability before and after transaction construction.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 31, 2026, 09:24 PM
Security Audit — agent-trust-hub — starchild-swap-and-bridge