OpenOcean token swap on 40+chains

• Outcome: Review
• Latest audit: May 28, 2026 · 8:21 AM UTC
• Version: 1.0.1

Overview

This is a disclosed OpenOcean swap skill, but it includes a fast path that can immediately broadcast irreversible token swaps and uses unsafe shell command construction.

Install only if you intentionally want an agent skill that can prepare and execute token swaps. Prefer the quote, build, and confirmed execute flows; avoid the fast path unless you have strict external controls, small transaction limits, trusted inputs, and accept irreversible transaction risk. The fast execution script should be fixed to remove eval and validate transaction fields before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill directs the agent to use shell commands like `python3 -c` or `bc` for amount conversion even though this is a quote-only workflow and the value can be computed safely within normal application logic. If user-controlled `AMOUNT` or `DECIMALS` are interpolated into a shell command, this creates an unnecessary command-injection path and expands the agent's capabilities beyond read-only HTTP requests.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script constructs a shell command string from transaction-derived fields such as TO, DATA, GAS, GAS_PRICE, CHAIN_ID, ETH_RPC_URL, and keystore path, then executes it with eval. Because several of these values originate from external input or the output of another script/API, a malicious or malformed value can break shell quoting and trigger arbitrary local command execution in addition to broadcasting an unintended transaction.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

│   │   └── SKILL.md
│   ├── swap-execute/       # Execute a swap via Foundry cast (with confirmation)
│   │   └── SKILL.md
│   ├── swap-execute-fast/  # Build and execute in one step (no confirmation)
│   │   ├── SKILL.md
│   │   └── scripts/
│   │       ├── fast-swap.sh      # Token resolution and route building

• Confidence: 95% confidence
• Finding: no confirmation

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

---
name: swap-execute-fast
description: This skill should be used when the user asks to "swap fast", "execute swap immediately", "automated swap", or wants to build and execute a swap in one step without confirmation prompts. EXTREMELY DANGEROUS: no confirmation, executes immediately.
metadata:
  tags:
    - defi

• Confidence: 98% confidence
• Finding: without confirmation

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

---
name: swap-execute-fast
description: This skill should be used when the user asks to "swap fast", "execute swap immediately", "automated swap", or wants to build and execute a swap in one step without confirmation prompts. EXTREMELY DANGEROUS: no confirmation, executes immediately.
metadata:
  tags:
    - defi

• Confidence: 98% confidence
• Finding: no confirmation

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# OpenOcean Swap Execute Fast Skill

Build and execute a swap in one step with no confirmation prompts. This skill is intended for automation use cases where the user wants immediate execution without manual approval.

## ⚠️ EXTREME DANGER WARNING

• Confidence: 97% confidence
• Finding: no confirmation

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## ⚠️ EXTREME DANGER WARNING

**This skill is extremely dangerous because:**
1. **No confirmation prompts** — executes immediately
2. **No review of parameters** — assumes everything is correct
3. **Irreversible** — on-chain transactions cannot be undone
4. **Gas costs incurred even if swap fails**

• Confidence: 99% confidence
• Finding: No confirmation

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Alternative: Fast Execution

For automated workflows, consider `/swap-execute-fast` which builds and executes in one step (no confirmation prompts). **Use with extreme caution.**

## Post-Execution

• Confidence: 95% confidence
• Finding: no confirmation

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.