ButterSwap

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:38 AM UTC
• Version: 1.0.0

Overview

This is a disclosed ButterSwap API helper that prepares cross-chain swap quotes and transaction data, but users should verify every crypto transaction before signing.

Install only if you intend to use Butter Router for cross-chain crypto swaps. Treat its output as transaction preparation, not approval: verify token contract addresses, source and destination chains, amounts, recipient and refund addresses, slippage, fees, route/bridge assumptions, and full wallet transaction details before signing. Do not share or use addresses you consider private unless you are comfortable sending that metadata to the Butter Router API.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: butter-swap
version: 1.0.0
description: |
  Butter Network DEX Aggregator for cross-chain token swaps. Get swap quotes, route transaction data, and cross-chain routing information.
  Use this skill whenever the user wants to swap tokens across different blockchain networks, needs cross-chain swap quotes, or wants to build cross-chain DEX aggregation features.
  Trigger: "cross-chain swap", "Butter Router", "swap tokens", "bridge tokens", "/route", "/swap", "get swap route", "get swap transaction", "ButterSwap"
repository: https://github.com/butternetwork/butter-swap-skill
user-invocable: true
allowed-tools:
  - B

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This README presents cross-chain swaps, routing, and transaction generation as straightforward actions but does not warn about safety-critical risks such as irreversible fund loss, spoofed token addresses, chain/address mismatches, slippage manipulation, bridge risk, or the need for user review before signing transactions. In a skill that helps generate swap and approve payloads, missing warnings can lead users or downstream agents to treat generated transaction data as safe by default, increasing the chance of harmful or unintended on-chain actions.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases are broad enough to activate this skill for many generic token swap or bridging requests, potentially routing users into an external third-party API flow without clear intent. In a financial context, incorrect skill invocation can expose wallet addresses and transaction parameters to an external service and increase the chance of users being guided into the wrong transaction flow.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill description does not clearly warn that wallet addresses, route hashes, token pairs, amounts, and related swap parameters are sent to an external API. In a crypto/financial workflow, this omission is dangerous because users may disclose sensitive transactional metadata without informed consent, creating privacy and phishing-risk exposure even if private keys are not transmitted.

Intent-Code Divergence

Low

• Confidence: 93% confidence
• Finding: The skill documentation earlier states that `entrance` is optional and defaults to `agent` when omitted, but this later instruction says `entrance` is required and must be `agent`. This is an active contradiction in the documented intent and could cause an agent to invoke the API differently than the rest of the file specifies.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: Most of the file describes the router entrance as `agent` and even says it defaults to `agent`, but the common error table says missing entrance should be fixed with `entrance=Butter%2B`. That directly conflicts with the documented invocation behavior for the same parameter.

Static analysis

No suspicious patterns detected.