OpenOcean token swap on 40+chains

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:52 AM UTC
• Version: 1.0.1

Overview

The skill is a disclosed OpenOcean swap tool, but its fast path can immediately broadcast real blockchain transactions and includes unsafe shell-script patterns that need review before installation.

Review this carefully before installing. Prefer the quote, swap-build, and confirmed swap-execute flows. Avoid swap-execute-fast unless you intentionally want unattended DeFi automation, use a dedicated low-balance wallet with narrow token allowances, verify router and chain details independently, and fix the eval/Python interpolation issues before running the scripts.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: skills/swap-execute-fast/scripts/execute-swap.sh:57
• Finding: Unverified Remote Installer Piped Directly to Bash<![CDATA[ ## Vulnerability Details **File Location**: `skills/swap-execute-fast/scripts/execute-swap.sh:57-62` **Vulnerability Type**: Remote mutable payload execution through `curl | bash` **Risk Level**: Medium ### Vulnerable Code ```bash if ! command -v cast &> /dev/null; then echo "Foundry 'cast' command not found. Please install Foundry:" echo " curl -L https://foundry.paradigm.xyz | bash" echo " foundryup" exit 1 fi ``` ### Technical Analysis When the `cast` command is unavailable, the script recommends piping the response from a remote URL directly into Bash. The command is displayed rather than automatically executed, so exploitation requires the user or an agent to follow the instruction. Nevertheless, it creates a remote code-execution channel whose effective payload can change after this Skill has been audited. The installer is not pinned to a version, saved for review, or verified using a checksum or cryptographic signature. HTTPS reduces passive interception risk but does not protect against compromise of the remote origin, account, hosting infrastructure, DNS resolution, or certificate trust chain. Installing Foundry is relevant to the Skill's declared functionality, but executing a mutable remote response without verification exceeds the minimum privilege and supply-chain exposure necessary to install that dependency safely. ### Attack Path 1. The user invokes `execute-swap.sh` on a system where `cast` is missing. 2. The script prints the `curl -L ... | bash` installation command. 3. The user or an automated agent follows the displayed instruction. 4. The remote origin, redirect destination, or delivery infrastructure returns modified shell code. 5. Bash immediately executes the response without local review or integrity verification. 6. The payload runs with all privileges of the invoking user. ### Impact Assessment A malicious installer could execute arbitrary commands under the user's account, read or alter local ...[truncated 314 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the `curl | bash` instruction with a link to the official installation documentation. 2. Prefer a package-manager installation or a version-pinned release artifact. 3. If scripted installation is necessary: - Download the artifact to a local file. - Require an explicit version. - Verify a publisher-provided cryptographic signature or pinned SHA-256 checksum. - Display the source and destination before execution. - Require explicit user approval after verification. 4. Do not follow unbounded redirects when retrieving executable content. 5. Document the expected publisher identity, version, checksum source, and verification procedure. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: skills/swap-execute-fast/scripts/execute-swap.sh:131
• Finding: Arbitrary Shell Command Injection Through eval-Based cast Invocation<![CDATA[ ## Vulnerability Details **File Location**: `skills/swap-execute-fast/scripts/execute-swap.sh:131-138, 198-203` **Vulnerability Type**: Shell command injection **Risk Level**: Critical ### Vulnerable Code ```bash CAST_CMD="cast send --rpc-url $ETH_RPC_URL \ --from $ETH_FROM \ --value $VALUE \ --gas $GAS \ --gas-price $GAS_PRICE \ --chain $CHAIN_ID \ $TO $DATA" ``` ```bash echo " Command: ${CAST_CMD:0:80}..." echo "" # Execute the command echo "Broadcasting transaction..." TX_RESULT=$(eval "$CAST_CMD" 2>&1) ``` Equivalent string construction is also used for Ledger, Trezor, and keystore execution paths at lines 141-189. ### Technical Analysis The script constructs a shell command as a string using values from environment variables, user input, local paths, and a remote API response. It then invokes `eval`, causing the shell to parse those values as command syntax for a second time. Potentially unsafe fields include: - `ETH_RPC_URL` and `ETH_FROM` from the environment. - `KEYSTORE_NAME` and the resulting keystore path. - `TO`, `VALUE`, `DATA`, `GAS`, `GAS_PRICE`, and `CHAIN_ID` from OpenOcean transaction JSON. None of these values are shell-escaped before being placed in `CAST_CMD`. JSON validation only establishes that the response is syntactically valid JSON; it does not establish that individual fields contain safe addresses, hexadecimal calldata, or decimal integers. For example, an RPC URL containing a command separator or command substitution can terminate the intended `cast` argument and append an arbitrary shell command when `eval` reparses the string. API-controlled transaction fields create an additional injection path if the upstream response is malicious or compromised. ### Attack Path 1. An attacker gains control over an interpolated value, such as a configured RPC URL, a keystore name, or a field returned by the swap API. 2. The value contains shell syntax such as a command separator, command substit ...[truncated 1017 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `eval` entirely. 2. Construct the command as a Bash array and invoke it directly: ```bash cmd=( cast send --rpc-url "$ETH_RPC_URL" --from "$ETH_FROM" --value "$VALUE" --gas "$GAS" --gas-price "$GAS_PRICE" --chain "$CHAIN_ID" "$TO" "$DATA" ) TX_RESULT=$("${cmd[@]}" 2>&1) ``` 3. Use separate arrays for environment, Ledger, Trezor, and keystore modes. 4. Validate every field before execution: - Addresses: exactly `0x` followed by 40 hexadecimal characters. - Calldata: `0x` followed by an even number of hexadecimal characters. - Value, gas, gas price, and chain ID: bounded unsigned decimal integers. - RPC URL: an expected `https://` URL or an explicitly approved local endpoint. - Keystore name: a restricted filename, with canonical-path verification preventing path traversal. 5. Ensure the selected wallet address matches the transaction sender. 6. Avoid printing credential-bearing RPC URLs or complete commands to logs. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: skills/swap-execute-fast/scripts/fast-swap.sh:14
• Finding: Python Code Injection Through Unvalidated Amount and Slippage Values<![CDATA[ ## Vulnerability Details **File Location**: `skills/swap-execute-fast/scripts/fast-swap.sh:14-18, 151-156` **Vulnerability Type**: Dynamic Python source-code injection **Risk Level**: Critical ### Vulnerable Code ```bash # Default values: slippage in basis points (100 bps = 1%). API expects percentage (1 = 1%), so we convert. SLIPPAGE_BPS=${6:-100} SLIPPAGE_API=$(python3 -c "print(round($SLIPPAGE_BPS / 100, 2))" 2>/dev/null || echo "1") # Ensure we have a value (default 1 = 1%) if [ -z "$SLIPPAGE_API" ]; then SLIPPAGE_API=1; fi ``` ```bash echo "Converting amount to wei..." >&2 AMOUNT_IN_WEI=$(python3 -c " amount = $AMOUNT decimals = $TOKEN_IN_DECIMALS result = int(amount * (10 ** decimals)) print(result) ") ``` ### Technical Analysis The script inserts shell variables directly into source code passed to `python3 -c`. `SLIPPAGE_BPS` and `AMOUNT` originate from command-line arguments. `TOKEN_IN_DECIMALS` can also originate from an API response when token resolution falls back to the remote token list. Because these values are treated as Python syntax rather than parsed as data, a crafted argument can terminate or extend the expected expression and invoke arbitrary Python functionality. The shell quoting does not protect against Python-language injection because variable expansion occurs before Python receives the source string. The `|| echo "1"` fallback for slippage does not prevent exploitation: a payload can execute side effects before returning a failure or success status. ### Attack Path 1. An attacker supplies a malicious amount or slippage argument, or controls a token-list response containing a malicious decimals value. 2. The script expands that value into the string supplied to `python3 -c`. 3. The resulting Python program contains attacker-supplied syntax. 4. Python executes the injected statements. 5. The injected Python code can import operating-system modules and run arbitrary local commands with the Skill runner's privileges. ...[truncated 388 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never interpolate untrusted values into Python source. 2. Pass values as positional arguments and parse them strictly: ```bash SLIPPAGE_API=$(python3 - "$SLIPPAGE_BPS" <<'PY' from decimal import Decimal, InvalidOperation import sys try: bps = Decimal(sys.argv[1]) except InvalidOperation: raise SystemExit("Invalid slippage") if bps < 0 or bps > 5000: raise SystemExit("Slippage is outside the allowed range") print(bps / Decimal(100)) PY ) ``` 3. Convert token amounts with `decimal.Decimal`, not binary floating-point arithmetic. 4. Enforce an input pattern such as `^[0-9]+([.][0-9]+)?$` for amounts. 5. Require token decimals to match a bounded integer pattern and range, such as 0 through 255. 6. Reject negative, non-finite, scientific-notation, and excessively precise values. 7. Fail closed on conversion errors rather than silently substituting a default slippage. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: skills/swap-execute-fast/scripts/fast-swap.sh:174
• Finding: Unvalidated API-Controlled Transaction Is Immediately Signed and Broadcast<![CDATA[ ## Vulnerability Details **File Location**: `skills/swap-execute-fast/scripts/fast-swap.sh:174-208; skills/swap-execute-fast/scripts/execute-swap.sh:93-116, 198-203` **Vulnerability Type**: Unsafe trust of remote transaction fields **Risk Level**: Critical ### Vulnerable Code ```bash SWAP_RESPONSE=$(curl -s "$SWAP_URL") if [ $? -ne 0 ]; then echo "Failed to call swap API" >&2 exit 1 fi RESPONSE_CODE=$(echo "$SWAP_RESPONSE" | jq -r '.code') if [ "$RESPONSE_CODE" != "200" ]; then ERROR_MSG=$(echo "$SWAP_RESPONSE" | jq -r '.message // "Unknown error"') echo "API error $RESPONSE_CODE: $ERROR_MSG" >&2 exit 1 fi FROM=$(echo "$SWAP_RESPONSE" | jq -r '.data.from') TO=$(echo "$SWAP_RESPONSE" | jq -r '.data.to') VALUE=$(echo "$SWAP_RESPONSE" | jq -r '.data.value') DATA=$(echo "$SWAP_RESPONSE" | jq -r '.data.data') GAS=$(echo "$SWAP_RESPONSE" | jq -r '.data.estimatedGas') CHAIN_ID=$(echo "$SWAP_RESPONSE" | jq -r '.data.chainId') # Use gas price from swap response so the transaction matches the quote (OpenOcean API v4). SWAP_GAS_PRICE=$(echo "$SWAP_RESPONSE" | jq -r '.data.gasPrice') if [ -z "$SWAP_GAS_PRICE" ] || [ "$SWAP_GAS_PRICE" = "null" ]; then SWAP_GAS_PRICE="$GAS_PRICE" fi if [ -z "$DATA" ] || [ "$DATA" = "null" ]; then echo "No calldata in response" >&2 exit 1 fi ``` The resulting JSON is then parsed and broadcast: ```bash FROM=$(echo "$TX_JSON" | jq -r '.from') TO=$(echo "$TX_JSON" | jq -r '.to') VALUE=$(echo "$TX_JSON" | jq -r '.value') DATA=$(echo "$TX_JSON" | jq -r '.data') GAS=$(echo "$TX_JSON" | jq -r '.gas') GAS_PRICE=$(echo "$TX_JSON" | jq -r '.gasPrice') CHAIN_ID=$(echo "$TX_JSON" | jq -r '.chainId') ``` ```bash # Execute the command echo "Broadcasting transaction..." TX_RESULT=$(eval "$CAST_CMD" 2>&1) ``` ### Technical Analysis The OpenOcean API response determines the transaction destination, native-token value, calldata, gas limit, gas price, sender field, and chain ID. The fast path checks the API s ...[truncated 2538 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Establish a chain-specific allowlist of expected router contracts and reject every other destination. 2. Verify that: - Returned `from` equals the requested sender. - The active signer equals the requested sender. - Returned chain ID equals both the requested chain and the RPC-reported chain ID. - Native value exactly matches the expected input or is zero for ERC-20 input. 3. Decode calldata locally and verify the function selector, input/output token addresses, amount, recipient, deadline, and minimum output. 4. Enforce configurable upper bounds for: - Transaction value. - Gas limit and gas price. - Total maximum gas fee. - Slippage. - Price impact. 5. Compare the swap response against an independently obtained quote where practical. 6. Run `eth_call` or `cast call` simulation and inspect asset deltas before signing. 7. Reject missing, malformed, negative, null, or out-of-range fields. 8. For unattended automation, require explicit preconfigured policy limits and a dedicated low-balance wallet with narrowly scoped token allowances. 9. Retain user confirmation for transactions outside those immutable automation limits. 10. Remove `eval` as described in the command-injection finding. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: skills/error-handling/SKILL.md:171
• Finding: Logging Guidance Can Persist Credential-Bearing URLs and Sensitive Error Data<![CDATA[ ## Vulnerability Details **File Location**: `skills/error-handling/SKILL.md:171-179` **Vulnerability Type**: Sensitive information exposure through excessive logging **Risk Level**: Low ### Vulnerable Code ```text ## Monitoring and Logging ### What to Log 1. **API calls** — URL, parameters, response code 2. **Token resolutions** — Symbol, address, chain 3. **Transaction attempts** — Hash, status, gas used 4. **Errors** — Full error object, timestamp ``` ### Technical Analysis The Skill recommends logging complete URLs, parameters, and full error objects without requiring redaction. RPC providers and APIs commonly place project identifiers or API tokens in URL paths or query strings. Error objects may also echo request URLs, authorization metadata, provider responses, local paths, or command details. Public transaction hashes and token addresses are not secrets by themselves. The risk arises from indiscriminate full-object and full-URL logging and the absence of guidance on redaction, access control, and retention. ### Attack Path 1. An API or RPC endpoint contains a credential or project token in its URL, or an error object includes sensitive request details. 2. The implementation follows the Skill's recommendation and records the complete URL, parameters, or error object. 3. Logs are stored in local files, centralized monitoring, CI output, or support bundles. 4. A user, operator, or attacker with log access obtains the embedded credential. 5. The credential is reused against the corresponding provider within its assigned permissions. ### Impact Assessment Exposure may allow unauthorized RPC or API usage, consumption of paid quotas, access to provider-level metadata, or disruption of service. The exact scope depends on the leaked credential's permissions. No instruction to log private keys, mnemonic phrases, or keystore contents was found. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace full URL logging with origin, normalized endpoint path, status code, latency, and a generated request identifier. 2. Redact: - Authorization and cookie headers. - API keys and tokens in paths or query strings. - Complete RPC URLs. - Keystore paths and wallet configuration. - Raw calldata unless explicitly required for restricted debugging. 3. Log allowlisted error fields rather than complete error objects. 4. Prevent secrets from reaching centralized logs, terminal history, CI output, and support bundles. 5. Apply access controls, encryption at rest, retention limits, and automated secret scanning to operational logs. 6. Document that private keys, mnemonic phrases, keystore contents, passwords, and signer tokens must never be logged. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (35)

External Script Fetching

High

• Category: Supply Chain

Content

echo "Checking prerequisites..."
if ! command -v cast &> /dev/null; then
    echo "Foundry 'cast' command not found. Please install Foundry:"
    echo "   curl -L https://foundry.paradigm.xyz | bash"
    echo "   foundryup"
    exit 1
fi

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

│   │   └── SKILL.md
│   ├── swap-execute/       # Execute a swap via Foundry cast (with confirmation)
│   │   └── SKILL.md
│   ├── swap-execute-fast/  # Build and execute in one step (no confirmation)
│   │   ├── SKILL.md
│   │   └── scripts/
│   │       ├── fast-swap.sh      # Token resolution and route building

• Confidence: 96% confidence
• Finding: The README explicitly advertises a skill that can build and broadcast blockchain swaps with no confirmation step. In an agent or plugin context, removing human confirmation before an irreversible financial transaction materially increases the risk of unintended asset transfer, prompt-injection-triggered execution, or misuse from malformed parameters.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### swap-execute-fast

Build and execute a swap in one step, with no confirmation prompt.

```
/swap-execute-fast 1 ETH to USDC on base from 0xYourAddress

• Confidence: 98% confidence
• Finding: This section states that the command will build and execute a swap in one step with no confirmation prompt. In a system where an AI agent can invoke skills, this enables autonomous irreversible on-chain actions, making accidental execution, prompt injection, or manipulated input far more dangerous than a normal quote/build workflow.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

/swap-execute-fast 0.5 WBTC to DAI on polygon from 0xYourAddress ledger
```

Requires `cast`, `curl`, and `jq`. **Extremely dangerous**: builds and executes immediately with no confirmation. Use only when you fully trust the parameters and understand the risks.

• Confidence: 99% confidence
• Finding: Although the README warns that the feature is 'Extremely dangerous,' it still documents immediate execution when the command is invoked. Warnings do not mitigate the core issue: an agent-integrated skill capable of immediate on-chain execution without confirmation can cause direct financial loss if triggered incorrectly or maliciously.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises capabilities that can lead to shell-based transaction execution workflows, but it does not declare any explicit tool scope such as allowed-tools or permissions. In an agent environment, missing scope boundaries can let the model invoke more powerful tools than intended during sensitive swap or wallet operations, increasing the blast radius of prompt mistakes or malicious downstream instructions.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| User intent | Skill file | When to use |
|-------------|------------|-------------|
| Get quote / check price | `skills/quote/SKILL.md` | "get a swap quote", "check swap price", "how much would I get for" |
| Build transaction | `skills/swap-build/SKILL.md` | "build a swap", "prepare swap transaction", "get swap calldata" |
| Execute (with confirmation) | `skills/swap-execute/SKILL.md` | "execute swap", "broadcast swap", "send transaction" |
| Execute fast (no confirmation) | `skills/swap-execute-fast/SKILL.md` | "swap fast", "execute immediately" — use with extreme caution |

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| User intent | Skill file | When to use |
|-------------|------------|-------------|
| Get quote / check price | `skills/quote/SKILL.md` | "get a swap quote", "check swap price", "how much would I get for" |
| Build transaction | `skills/swap-build/SKILL.md` | "build a swap", "prepare swap transaction", "get swap calldata" |
| Execute (with confirmation) | `skills/swap-execute/SKILL.md` | "execute swap", "broadcast swap", "send transaction" |
| Execute fast (no confirmation) | `skills/swap-execute-fast/SKILL.md` | "swap fast", "execute immediately" — use with extreme caution |
| Errors and troubleshooting | `skills/error-handling/SKILL.md` | API errors, token resolution failures, execution failures |

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

|-------------|------------|-------------|
| Get quote / check price | `skills/quote/SKILL.md` | "get a swap quote", "check swap price", "how much would I get for" |
| Build transaction | `skills/swap-build/SKILL.md` | "build a swap", "prepare swap transaction", "get swap calldata" |
| Execute (with confirmation) | `skills/swap-execute/SKILL.md` | "execute swap", "broadcast swap", "send transaction" |
| Execute fast (no confirmation) | `skills/swap-execute-fast/SKILL.md` | "swap fast", "execute immediately" — use with extreme caution |
| Errors and troubleshooting | `skills/error-handling/SKILL.md` | API errors, token resolution failures, execution failures |

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| Get quote / check price | `skills/quote/SKILL.md` | "get a swap quote", "check swap price", "how much would I get for" |
| Build transaction | `skills/swap-build/SKILL.md` | "build a swap", "prepare swap transaction", "get swap calldata" |
| Execute (with confirmation) | `skills/swap-execute/SKILL.md` | "execute swap", "broadcast swap", "send transaction" |
| Execute fast (no confirmation) | `skills/swap-execute-fast/SKILL.md` | "swap fast", "execute immediately" — use with extreme caution |
| Errors and troubleshooting | `skills/error-handling/SKILL.md` | API errors, token resolution failures, execution failures |

**Reference files** (read before calling APIs):

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Get quote / check price | `skills/quote/SKILL.md` | "get a swap quote", "check swap price", "how much would I get for" |
| Build transaction | `skills/swap-build/SKILL.md` | "build a swap", "prepare swap transaction", "get swap calldata" |
| Execute (with confirmation) | `skills/swap-execute/SKILL.md` | "execute swap", "broadcast swap", "send transaction" |
| Execute fast (no confirmation) | `skills/swap-execute-fast/SKILL.md` | "swap fast", "execute immediately" — use with extreme caution |
| Errors and troubleshooting | `skills/error-handling/SKILL.md` | API errors, token resolution failures, execution failures |

**Reference files** (read before calling APIs):

• Confidence: 96% confidence
• Finding: Advertising an execution mode with no confirmation enables autonomous high-impact actions in a financial context, where the agent could proceed to prepare or broadcast irreversible swaps without a final human checkpoint. Because this skill package is specifically for DeFi transactions across many chains, the context makes such autonomy substantially more dangerous than in a read-only or educational skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The top-level skill advertises a fast execution path with no confirmation, but the warning is minimal and does not clearly explain that swaps are irreversible, may move real funds, and require wallet authority. In a DeFi context, that omission materially increases the risk of accidental or manipulated asset transfers, especially when the entry-point skill routes users into sub-skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| Build transaction | `skills/swap-build/SKILL.md` | "build a swap", "prepare swap transaction", "get swap calldata" |
| Execute (with confirmation) | `skills/swap-execute/SKILL.md` | "execute swap", "broadcast swap", "send transaction" |
| Execute fast (no confirmation) | `skills/swap-execute-fast/SKILL.md` | "swap fast", "execute immediately" — use with extreme caution |
| Errors and troubleshooting | `skills/error-handling/SKILL.md` | API errors, token resolution failures, execution failures |

**Reference files** (read before calling APIs):

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| Build transaction | `skills/swap-build/SKILL.md` | "build a swap", "prepare swap transaction", "get swap calldata" |
| Execute (with confirmation) | `skills/swap-execute/SKILL.md` | "execute swap", "broadcast swap", "send transaction" |
| Execute fast (no confirmation) | `skills/swap-execute-fast/SKILL.md` | "swap fast", "execute immediately" — use with extreme caution |
| Errors and troubleshooting | `skills/error-handling/SKILL.md` | API errors, token resolution failures, execution failures |

**Reference files** (read before calling APIs):

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| Build transaction | `skills/swap-build/SKILL.md` | "build a swap", "prepare swap transaction", "get swap calldata" |
| Execute (with confirmation) | `skills/swap-execute/SKILL.md` | "execute swap", "broadcast swap", "send transaction" |
| Execute fast (no confirmation) | `skills/swap-execute-fast/SKILL.md` | "swap fast", "execute immediately" — use with extreme caution |
| Errors and troubleshooting | `skills/error-handling/SKILL.md` | API errors, token resolution failures, execution failures |

**Reference files** (read before calling APIs):

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| Build transaction | `skills/swap-build/SKILL.md` | "build a swap", "prepare swap transaction", "get swap calldata" |
| Execute (with confirmation) | `skills/swap-execute/SKILL.md` | "execute swap", "broadcast swap", "send transaction" |
| Execute fast (no confirmation) | `skills/swap-execute-fast/SKILL.md` | "swap fast", "execute immediately" — use with extreme caution |
| Errors and troubleshooting | `skills/error-handling/SKILL.md` | API errors, token resolution failures, execution failures |

**Reference files** (read before calling APIs):

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| Build transaction | `skills/swap-build/SKILL.md` | "build a swap", "prepare swap transaction", "get swap calldata" |
| Execute (with confirmation) | `skills/swap-execute/SKILL.md` | "execute swap", "broadcast swap", "send transaction" |
| Execute fast (no confirmation) | `skills/swap-execute-fast/SKILL.md` | "swap fast", "execute immediately" — use with extreme caution |
| Errors and troubleshooting | `skills/error-handling/SKILL.md` | API errors, token resolution failures, execution failures |

**Reference files** (read before calling APIs):

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

| Build transaction | `skills/swap-build/SKILL.md` | "build a swap", "prepare swap transaction", "get swap calldata" |
| Execute (with confirmation) | `skills/swap-execute/SKILL.md` | "execute swap", "broadcast swap", "send transaction" |
| Execute fast (no confirmation) | `skills/swap-execute-fast/SKILL.md` | "swap fast", "execute immediately" — use with extreme caution |
| Errors and troubleshooting | `skills/error-handling/SKILL.md` | API errors, token resolution failures, execution failures |

**Reference files** (read before calling APIs):

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The `/swap` section documents that the API returns `to`, `value`, and encoded `data` calldata for submission, but it does not prominently warn that this output is executable on-chain transaction material that can directly move user funds if signed. In an agent skill context, that omission is risky because downstream tooling may treat the response as informational rather than as a high-sensitivity action artifact, increasing the chance of unsafe auto-execution or inadequate user confirmation.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly recommends invoking shell commands (`python3 -c`, `bc`) to perform amount conversion even though the task is a read-only quote workflow. If any part of `AMOUNT` or `DECIMALS` is derived from user input without strict validation, this creates an unnecessary command-execution surface and can enable shell injection or unsafe local execution by the agent.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly instructs the agent to run a local `python3 -c` command to perform amount conversion. Even though the stated goal is simple arithmetic for token decimals, introducing local command execution into a skill increases the attack surface and normalizes shell/Python execution where pure in-agent computation would suffice. In this context, the danger is moderate rather than severe because the command template itself is simple and not overtly exfiltrative, but it still creates unnecessary execution risk if user-controlled values are interpolated.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **Deadline**: OpenOcean uses default 20-minute deadline

### Native vs ERC-20
- **Native token input**: `value` > 0, no approval needed
- **ERC-20 input**: `value` = 0, approval required before swap
- **Always check**: Token approvals before attempting swap

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

---
name: swap-execute-fast
description: This skill should be used when the user asks to "swap fast", "execute swap immediately", "automated swap", or wants to build and execute a swap in one step without confirmation prompts. EXTREMELY DANGEROUS: no confirmation, executes immediately.
metadata:
  tags:
    - defi

• Confidence: 99% confidence
• Finding: This finding is substantively the same risky behavior as the prior one: the description normalizes autonomous execution with 'no confirmation' for swaps. Because swaps are irreversible and wallet-bearing tools are involved, the lack of a human checkpoint materially increases the chance of unauthorized or erroneous asset transfers.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

---
name: swap-execute-fast
description: This skill should be used when the user asks to "swap fast", "execute swap immediately", "automated swap", or wants to build and execute a swap in one step without confirmation prompts. EXTREMELY DANGEROUS: no confirmation, executes immediately.
metadata:
  tags:
    - defi

• Confidence: 99% confidence
• Finding: This finding is substantively the same risky behavior as the prior one: the description normalizes autonomous execution with 'no confirmation' for swaps. Because swaps are irreversible and wallet-bearing tools are involved, the lack of a human checkpoint materially increases the chance of unauthorized or erroneous asset transfers.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# OpenOcean Swap Execute Fast Skill

Build and execute a swap in one step with no confirmation prompts. This skill is intended for automation use cases where the user wants immediate execution without manual approval.

## ⚠️ EXTREME DANGER WARNING

• Confidence: 98% confidence
• Finding: The body of the skill reiterates that it will execute a swap in one step with no confirmation prompts, confirming the unsafe design is intentional rather than incidental. In the context of DeFi execution, this makes the skill more dangerous, not less, because it performs high-impact external actions on behalf of the user without a safety pause.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## ⚠️ EXTREME DANGER WARNING

**This skill is extremely dangerous because:**
1. **No confirmation prompts** — executes immediately
2. **No review of parameters** — assumes everything is correct
3. **Irreversible** — on-chain transactions cannot be undone
4. **Gas costs incurred even if swap fails**

• Confidence: 99% confidence
• Finding: The warning section admits there is no confirmation and no review of parameters, meaning the design knowingly bypasses core transactional safeguards. That is dangerous because parameter extraction from user text can be ambiguous, and any wrong token, amount, sender, chain, or slippage value will be submitted on-chain immediately.

Static analysis

No suspicious patterns detected.