Security audit
Security checks for vulnerabilities and agentic risk
The skill provides a disclosed swap-check service with an unpaid demo and payments controlled by the operator’s existing client.
Start with the unpaid demo. For paid use, require your existing client to enforce the approved merchant, Base USDC, and a 0.001 USDC limit; quotes need a separate 0.01 USDC allowance. Keep wallet secrets local and attribution labels non-personal. The live service and external payment client were not verified.
Without declared permissions the skill's intent is opaque and cannot be validated.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Use POST https://api.usesaferoute.com/v1/swap-safety-check with:
{ "from": "USDC", "to": "WETH", "amount": "1" }
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
The bundled helper exports `runFirstCall({fetchImpl, paidFetch, source, applicationId})` for an existing caller-controlled x402 fetch. Passing paidFetch permits one paid service request after the unpaid inspection; callers must apply the above payment policy. Do not add automatic retries after uncertain settlement. A successful payment response plus a received service result establishes that call only.
For an optional quote use `POST /v1/quote`, or MCP tool `get_safe_swap_quote` at `https://api.usesaferoute.com/mcp`, after validating the live schema and obtaining the separate 0.01 USDC allowance. MCP safety tool: `check_base_swap`. Do not escalate to signing, broadcasting or a funded trade from a request to evaluate an API.
## Learn what worked
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
{ "from": "USDC", "to": "WETH", "amount": "1" }
Use the live [OpenAPI](https://api.usesaferoute.com/openapi.json) for supported assets and current schemas. Inspect the challenge first. Before a paid call, verify scheme exact, Base `eip155:8453`, canonical USDC `0x833589fCD6eDb6E08f4C7C32D4f71b54bdA02913`, the intended merchant and an application-controlled spend ceiling. Keep wallet credentials in the caller’s existing local payment client; never send them to SafeRoute or ask for seed phrases.
The bundled helper exports `runFirstCall({fetchImpl, paidFetch, source, applicationId})` for an existing caller-controlled x402 fetch. Passing paidFetch permits one paid service request after the unpaid inspection; callers must apply the above payment policy. Do not add automatic retries after uncertain settlement. A successful payment response plus a received service result establishes that call only.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import { pathToFileURL } from "node:url";
export const endpoint = "https://api.usesaferoute.com/v1/swap-safety-check";
export const input = { from: "USDC", to: "WETH", amount: "1" };
export const payTo = "0x08a6a2ddecdebdbfcb29d725042a6f3d74849e08";
export const usdc = "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913";