Gasless stop-loss, limit, TWAP, take-profit & market swaps across 8 EVM chains. Zero fees.

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:47 AM UTC
• Version: 2.5.5

Overview

This skill is a clearly disclosed DeFi order-building guide that submits signed swap orders to its stated relay, with no hidden code execution or persistence.

Before installing, understand that this skill can help prepare and submit real token swap orders. Review every chain, token, amount, limit, deadline, recipient, allowance, and relay destination before approving or signing, and do not reuse signatures after changing order fields.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples explicitly tell users to copy a complete relay payload shape and replace fields, while showing a populated signature field and offering no warning that signatures are bound to exact order parameters and must never be reused or mixed across modified payloads. In a swap-order skill, this can lead users or downstream agents to mishandle signed data, accidentally submit invalid or unintended orders, or leak reusable signing artifacts into logs and automation flows.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sign.md (reported line 43)May include surrounding context.

'{order: $typed[0].message, signature: $sig, status: "pending"}' \

./relay-payload.json

curl -fsS -X POST 'https://agents-sink.orbs.network/orders/new'
-H 'content-type: application/json'
--data @./relay-payload.json

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sign.md (reported line 57)May include surrounding context.

md

status: "pending",
};

const response = await fetch("https://agents-sink.orbs.network/orders/new", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify(relayPayload),

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This is a manifest file, so vague-trigger review applies. The description 'Use for gasless non-custodial EVM market, limit, TWAP, stop-loss, take-profit, delayed-start swaps' reads like a broad activation instruction but does not specify concrete trigger phrases, scope boundaries, or negative examples, which could lead to overbroad skill matching.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.