ZeroEx Swap

• Analyzed: May 12, 2026, 4:28 AM
• Findings: 1
• Version: 1.0.1
• Hash: f58bb5481e94d3fb5e5c748f2f48c2174e01db19d4dc96d00f22d325b375dfab
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is classified as suspicious due to its inherent high-risk capabilities, specifically requiring and directly handling a user's `PRIVATE_KEY` and `ZEROEX_API_KEY` to execute real cryptocurrency swaps. While the code (`swap.js`, `quote.js`) transparently implements the stated purpose of interacting with the 0x Swap API and includes some security best practices (e.g., exact allowance), the direct handling of a private key for real fund transactions represents a significant risk. The `SKILL.md` instructions guide the AI agent to perform these high-risk operations, which, while aligned with the skill's purpose, could lead to financial loss if misused or if the agent's environment is compromised.