skills/zeko-labs/zeko-skills/zeko/Gen Agent Trust Hub

zeko

Pass

Audited by Gen Agent Trust Hub on May 8, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: Executes shell commands via curl and CLI tools like zeko-bridge and zeko-faucet to interact with blockchain endpoints and perform operations like bridging assets or claiming faucet funds.
  • [EXTERNAL_DOWNLOADS]: Installs the @zeko-labs/bridge-cli, @zeko-labs/faucet-cli, and o1js packages from official registries as part of its setup, which are necessary for the skill's core functionality.
  • [DATA_EXFILTRATION]: Performs network operations targeting official Zeko and Mina blockchain endpoints (e.g., testnet.zeko.io, gateway.mina.devnet.zeko.io) to query account balances and broadcast transactions. No unauthorized data transmission to third-party or untrusted domains was found.
  • [CREDENTIALS_UNSAFE]: References sensitive environment variables like WALLET_PRIVATE_KEY and MINA_PRIVATE_KEY for signing blockchain transactions. The skill follows best practices by requesting these through the environment rather than hardcoding values or including instructions to log them.
  • [DYNAMIC_EXECUTION]: Generates and executes short Node.js scripts using o1js for complex tasks like cryptographic signing and unit conversion. These scripts are constructed from static templates within the skill and use local environment variables for inputs.
Audit Metadata
Risk Level
SAFE
Analyzed
May 8, 2026, 07:49 PM