中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 15/100
Last scan:1 day ago Rescan
15 /100
tempo-stable-uniswap-swaps
Tempo stablecoin and token swap operations for agents using Foundry (cast) and Uniswap Trade API
Legitimate Tempo stablecoin/DeFi swap skill using Foundry and Uniswap API with properly documented functionality; the curl|bash pattern for Foundry installation is a standard, documented approach from Paradigm.
Skill Nametempo-stable-uniswap-swaps
Duration33.7s
Enginepi
✓
Safe to install
No action required. Consider pinning Foundry version in production deployments.

Findings 1 items

Severity Finding Location
Low
curl|bash installation pattern detected Doc Mismatch
Line 36 uses 'curl -L https://foundry.paradigm.xyz | bash' for Foundry installation. While this pattern is often associated with supply chain risks, in this case it is the official, documented installation method for Foundry (a well-known Ethereum development framework by Paradigm). The risk is mitigated by the source being a trusted, established project.
curl -L https://foundry.paradigm.xyz | bash
→ Consider documenting this as intentional Foundry installation. For production use, consider pinning Foundry version or using package manager installation.
 SKILL.md:36
ResourceDeclaredInferredStatusEvidence
Filesystem NONE NONE — No file operations in code
Network READ READ ✓ Aligned SKILL.md:56-66 - curl to Uniswap API, SKILL.md:88 - eth_call to RPC
Shell WRITE WRITE ✓ Aligned SKILL.md:36 - foundryup, SKILL.md:50 - cast send for transfers
Environment READ READ ✓ Aligned SKILL.md:46 - PRIVATE_KEY, UNISWAP_API_KEY
Skill Invoke NONE NONE — No skill invocation
Clipboard NONE NONE — No clipboard access
Browser NONE NONE — No browser access
Database NONE NONE — No database access
1 Critical 8 findings
💀
Critical Dangerous Command 危险 Shell 命令
curl -L https://foundry.paradigm.xyz | bash
SKILL.md:36
🔗
Medium External URL 外部 URL
https://rpc.presto.tempo.xyz
SKILL.md:19
💰
Medium Wallet Address 加密货币钱包地址
0x20C0000000000000000000000000000000000000
SKILL.md:20
💰
Medium Wallet Address 加密货币钱包地址
0x20c000000000000000000000b9537d11c60e8b50
SKILL.md:21
💰
Medium Wallet Address 加密货币钱包地址
0x20C000000000000000000000d5d5815Ae71124d1
SKILL.md:22
💰
Medium Wallet Address 加密货币钱包地址
0x000000000022D473030F116dDEE9F6B43aC78BA3
SKILL.md:23
🔗
Medium External URL 外部 URL
https://foundry.paradigm.xyz
SKILL.md:36
🔗
Medium External URL 外部 URL
https://trade-api.gateway.uniswap.org/v1/quote
SKILL.md:77

File Tree

1 files · 4.2 KB · 141 lines
Markdown 1f · 141L
└─ 📝 SKILL.md Markdown 141L · 4.2 KB

Security Positives

✓ All functionality declared in SKILL.md - no hidden behavior
✓ No credential exfiltration - PRIVATE_KEY used only for local blockchain operations
✓ No obfuscation or base64-encoded payloads
✓ Standard Uniswap/DeFi patterns used correctly
✓ Permit2 approval patterns are standard and documented
✓ No access to sensitive paths (~/.ssh, ~/.aws, .env files)
✓ Network calls limited to legitimate endpoints (Uniswap API, Tempo RPC)
✓ No reverse shell, C2, or data theft behavior
✓ Foundry/cast is a widely-used legitimate blockchain development tool