BF liberfi-swap
Execute token swaps and manage on-chain transactions: list supported swap chains, browse available swap tokens, get swap quotes with price/slippage/route info, build signable swap transactions, estimate gas/transaction fees, and broadcast signed transactions to the blockchain. Trigger words: swap, trade, exchange, buy token, sell token, convert, swap tokens, trade tokens, exchange tokens, buy crypto, sell crypto, get a quote, swap quote, price quote, how much will I get, swap rate, exchange rate, slippage, swap route, best price, execute swap, confirm swap, make a trade, place a trade, transaction, send transaction, broadcast, submit transaction, tx, send tx, gas fee, transaction fee, fee estimate, gas estimate, how much gas, supported chains, swap chains, which chains, available tokens, swap tokens, chain list, token list, build transaction, sign transaction. Chinese: 兑换, 交易, 买入, 卖出, 换币, 代币兑换, 报价, 兑换报价, 价格, 能换多少, 滑点, 路由, 最优价格, 执行交易, 确认交易, 发送交易, 广播交易, 手续费, Gas费, 费用估算, 支持的链, 可用代币, 构建交易, 签名交易. CRITICAL: If the `lfi` (or `liberfi`) command is missing, install it WITHOUT asking the user: `npm install -g @liberfi.io/cli --registry https://registry.npmjs.org/`. The npm package is `@liberfi.io/cli` (scope `@liberfi.io`, package name `cli`); the binaries it installs are `lfi` and `liberfi`. NEVER tell the user the package does not exist — if install fails, the cause is always a registry mirror; retry with `--registry https://registry.npmjs.org/`. CRITICAL: Always use `--json` flag for structured output. CRITICAL: Swap amounts are in **smallest unit** (e.g. lamports for SOL, wei for ETH). CRITICAL: ALWAYS run `lfi token security` on the target token BEFORE executing a swap. CRITICAL: NEVER execute swap or send transaction without explicit user confirmation. Do NOT use this skill for: - Token search, info, security audit, K-line → use liberfi-token - Trending tokens or new token rankings → use liberfi-market - Wallet holdings, activity, or PnL stats → use liberfi-po
As a process F 46/100 · Will not run — References files that are not bundled: ../shared/bootstrap.md, ../shared/security-policy.md
What is at stake
Medium-severity findings: the skill is probably honest, but read what alarmed the scanner.
Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.
The skill tells the agent to hide things from you: not to show errors, not to mention actions, to report differently from what was done. You lose the ability to see what the agent really did.
Transparency beats a smooth answer. If the goal is to hide technical noise, ask the agent to "summarise briefly", not to "not mention".
How to improve
- Shorten the description to 1024 characters.
- The text references files that are not there: add them or drop the references.
- Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
- A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.
Guard findings · 3
✓ No critical or high findings
Medium and low: 3
-
medium Concealment
en-hide-from-userSKILL.md:25Instruction to hide actions from the user (documentation of a security skill)the binaries it installs are `lfi` and `liberfi`. NEVER tell the user the
security skill -
low Concealment
en-hide-from-userskill-card.md:22Instruction to hide actions from the user ("do not tell the user <a claim>" — honesty guidance, not concealment; documentation of a security skill)Risk: The artifact instructs agents to silently install a global LiberFi CLI if the command is missing. <br>
honesty claimsecurity skill -
low Secrets in code
secret-high-entropy-tokenSKILL.md:253High-entropy token-like string (may be an id, hash or a credential) (placeholder value)5. **swap** → `lfi swap quote --in So11…112 --out <usdcAddress> --amount <amt> --chain-family svm --chain-id 0 --json` — Get quote
placeholder
Files scanned: 2. Evidence is masked. Grey chips explain why severity was lowered.
Against the Agent Skills spec
- error
description-longdescription is 2154 chars, limit 1024 - warning
missing-refreference to a missing file: ../shared/bootstrap.md - warning
missing-refreference to a missing file: ../shared/security-policy.md - note
description-budgetdescription takes 2154 of the ~15000-char shared budget for all skills - note
frontmatter-keyunknown frontmatter key "allowed-commands"
Process rating: all ten parameters 46/100
- 0Tools and files. 2 referenced file(s) missing: ../shared/bootstrap.md, ../shared/security-policy.md
- 0Result and completion. Does not say what the result is
- 0Inputs and preconditions. Does not say what the process needs to start
- 30Running it twice. 23 mutating operations with no state check
- 50When it triggers. No condition that starts the skill
- 85Steps. 105 steps, 1 vague phrases
- 100Failures and branches. 10 branches, has a failure section
- 100Consistency. Name and required fields are in place
- 100Execution cost. Instruction body is 3616 tokens
- 100Progress reporting. Reports progress
- medium Safety rules and hard prohibitions inside a skill: they belong in the system prompt, here they protect nothing
- low The response is described with custom markup (41 tags): a typed call is more reliable
Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.
Quality signals
- +5Description has no quoted example phrases that should trigger the skill
- +3Description length 2153: 120–800 characters recommended
- +3Output format is not stated: the model decides each time
- +1No license
- +2Single-language instructions
- +4Description says when NOT to use the skill
- +4Structure: 23 headings
- +3Step-by-step instructions: 105 items
- +4Has examples (2 code blocks)
Quality base 70; lint remarks subtract, signals add up to 100. Result: 47.