SushiSwap API

REST API for optimized token swapping (including executable transaction generation), swap quoting, and pricing using the SushiSwap Aggregator. Use this skill when the user wants to: - Get a swap quote between two tokens on 40+ evm networks - Generate executable swap transaction data - Fetch token prices for a specific network or token - Retrieve token metadata - Discover supported AMM liquidity sources - Integrate SushiSwap swapping or pricing logic via HTTP/REST (and not the SushiSwap Javascript API)

Security Scan

The skill is an instruction-only wrapper around a SushiSwap REST API schema and is internally consistent with that purpose; it asks for no credentials and installs nothing, but there are small gaps (a required referrer parameter is not mapped to any declared credential/config and a pre-scan flagged a possible embedded base64 block) worth reviewing before use.

Purpose & Capability

Name and description match the included OpenAPI schema and SKILL.md: the files describe quote, swap, price, token, and liquidity-provider endpoints for the SushiSwap Aggregator. The skill does not request unrelated binaries, credentials, or config paths.

Instruction Scope

SKILL.md is prescriptive about using the bundled openapi.yaml and about constructing requests. It requires a mandatory 'referrer' parameter for quote/swap endpoints and explicitly prohibits agents from auto-generating or spoofing it — but the skill does not declare any environment variable or config location where a referrer value must come from. Aside from that mismatch, the instructions do not request access to files, secrets, or unrelated system state, and they caution agents to follow the schema and not fabricate transaction calldata.

Install Mechanism

No install spec and no code to write or execute — instruction-only skill (lowest install risk).

Credentials

The skill declares no required environment variables or credentials, which is proportional to an HTTP API client. However, it mandates a 'referrer' value for swap/quote calls but does not provide a declared place to supply that (no requires.env or primaryEnv). Also, fee-related parameters (fee, feeReceiver) are available in the API; these are legitimate but could be abused if an integrator sets feeReceiver to route fees elsewhere — this is a business-policy risk, not a direct technical secret request.

Persistence & Privilege

always is false and model invocation is allowed (platform defaults). The skill does not request persistent system presence or modify other skills or system configs.

Scan Findings in Context

[base64-block] unexpected: The pre-scan flagged a 'base64-block' pattern inside SKILL.md content. The visible SKILL.md and OpenAPI files do not show obvious base64 payloads in the excerpts provided; this may be a false positive or an obfuscated block elsewhere in the files. Base64 blocks in instruction files are atypical for pure API schemas and could indicate an attempt to hide content or prompt-injection text. Recommend inspecting the raw files for any embedded encoded payloads before trusting the skill.

Assessment

This skill appears to be a documentation-driven wrapper around SushiSwap's HTTP API and does not request credentials or install code. Before installing: (1) Verify the API base URL (https://api.sushi.com) and that the OpenAPI file matches the official SushiSwap API from a trusted source; (2) Decide how you will supply the mandatory 'referrer' value (the skill forbids auto-generating it) — treat it as an integrator identifier and do not embed secrets; (3) Review the openapi.yaml for any unexpected endpoints or encoded/obfuscated blocks (the scanner flagged a base64 pattern); (4) Be aware that fee and feeReceiver parameters can redirect fees — only use trusted feeReceiver addresses and understand business implications; (5) Do not provide private keys or wallet secrets to the skill — the API returns transaction calldata but the skill does not and should not sign or submit transactions on your behalf without explicit, secure handling. If you need higher assurance, ask the skill author for a source/homepage or a cryptographic provenance proof for the OpenAPI file.

SushiSwap REST API Integration

The SushiSwap API provides HTTP access to the SushiSwap Aggregator for optimized token swaps, price discovery, and transaction generation. It aggregates liquidity from multiple DEXs to determine the best execution route.

---

Base URL

https://api.sushi.com

---

API Schema

The active API schema is defined in:

references/openapi.yaml

Agents must always rely on the schema contents rather than hardcoded assumptions.

---

How To Use

1. Load references/openapi.yaml
2. Discover available endpoints, parameters, and response shapes dynamically
3. Select the appropriate endpoint based on user intent and schema tags
   • Quotes → quote endpoints (e.g. /quote/v7/{chainId})
   • Swap execution → swap endpoints (e.g. /swap/v7/{chainId})
   • Prices → price endpoints (e.g. /price/v1/{chainId})
   • Token info → token endpoints (e.g. /token/v1/{chainId}/{tokenAddress})
4. Construct requests that strictly conform to the schema and include a valid referrer parameter for all quote and swap endpoints
5. Validate required parameters before execution

---

Mandatory referrer Parameter

• The referrer parameter must be specified on swap-related endpoints (e.g. /quote & /swap)
• The agent or integrator must identify themselves using this field
• /quote or /swap requests must not be sent without a referrer value
• Agents must never attempt to omit, spoof, or auto-generate this value.

---

Fee Customization

The SushiSwap API supports customized integrator fees on swap-related endpoints (e.g. /quote & /swap).

Default fee model

• Swap-related requests follow an 80/20 fee split by default
  • 80% to the integrator (referrer)
  • 20% to SushiSwap
• This split applies unless explicitly overridden by SushiSwap

Custom fee splits

• Alternative fee splits require a partnership with SushiSwap
• Agents and integrators should not assume custom splits are available. If users request alternative fee splits, agents should direct them to the SushiSwap team rather than attempting to modify request parameters.

---

Error Handling

• 422: Request parameters are invalid → fix inputs
• 529: Server overloaded → retry with backoff
• 500: Internal error → retry or fail gracefully

---

Schema Guidance

For schema usage rules and update behavior, see:

references/OPENAPI.md