zeko
Pass
Audited by Gen Agent Trust Hub on May 8, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: Executes shell commands via
curland CLI tools likezeko-bridgeandzeko-faucetto interact with blockchain endpoints and perform operations like bridging assets or claiming faucet funds. - [EXTERNAL_DOWNLOADS]: Installs the
@zeko-labs/bridge-cli,@zeko-labs/faucet-cli, ando1jspackages from official registries as part of its setup, which are necessary for the skill's core functionality. - [DATA_EXFILTRATION]: Performs network operations targeting official Zeko and Mina blockchain endpoints (e.g.,
testnet.zeko.io,gateway.mina.devnet.zeko.io) to query account balances and broadcast transactions. No unauthorized data transmission to third-party or untrusted domains was found. - [CREDENTIALS_UNSAFE]: References sensitive environment variables like
WALLET_PRIVATE_KEYandMINA_PRIVATE_KEYfor signing blockchain transactions. The skill follows best practices by requesting these through the environment rather than hardcoding values or including instructions to log them. - [DYNAMIC_EXECUTION]: Generates and executes short Node.js scripts using
o1jsfor complex tasks like cryptographic signing and unit conversion. These scripts are constructed from static templates within the skill and use local environment variables for inputs.
Audit Metadata