starchild-swap-and-bridge
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches data and transaction calldata from the WOOFi API (
sapi.woofi.com) and the LayerZero Value Transfer API (transfer.layerzero-api.com). These are well-known services in the decentralized finance sector. - [COMMAND_EXECUTION]: Utilizes the
curlbinary to perform quote requests to WOOFi's public endpoints. This is a standard and expected method for API interaction in this context. - [DATA_EXFILTRATION]: Performs network operations to external DeFi APIs. All calls are routed to official protocol endpoints or through a local proxy (
core.http_client). The skill does not access or transmit sensitive local files or credentials. - [SAFE]: The skill incorporates significant security guardrails for financial operations:
- Approval Sequencing: It mandates re-quoting after a token approval is confirmed to prevent the use of stale price data or invalid calldata.
- Human-in-the-Loop: Explicitly requires the agent to decode and present critical transaction details (spender address, amount, destination chain) for user review before signing any transaction.
- Validation: Implements two-stage validation for token balances and gas availability before and after transaction construction.
Audit Metadata