bridge
Facilitates cross-chain token transfers using Wormhole and CCTP protocols for seamless blockchain transactions.
Install this skill
Security score
The bridge skill was audited on Feb 19, 2026 and we found 22 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 80 | console.log(`Fee: $${quote.fee}`); |
Template literal with variable interpolation in command context
| 81 | console.log(`Est. time: ${quote.estimatedTime} seconds`); |
Template literal with variable interpolation in command context
| 97 | console.log(`Transfer initiated: ${transfer.txHash}`); |
Template literal with variable interpolation in command context
| 98 | console.log(`VAA: ${transfer.vaa}`); |
Template literal with variable interpolation in command context
| 99 | console.log(`Status: ${transfer.status}`); |
Template literal with variable interpolation in command context
| 108 | console.log(`Redeemed: ${redeem.txHash}`); |
Template literal with variable interpolation in command context
| 109 | console.log(`Amount received: ${redeem.amount} USDC`); |
Template literal with variable interpolation in command context
| 127 | console.log(`CCTP transfer: ${transfer.txHash}`); |
Template literal with variable interpolation in command context
| 128 | console.log(`Message: ${transfer.messageHash}`); |
Template literal with variable interpolation in command context
| 148 | console.log(`Status: ${status.status}`); |
Template literal with variable interpolation in command context
| 151 | console.log(`Source confirmations: ${status.sourceConfirmations}`); |
Template literal with variable interpolation in command context
| 152 | console.log(`VAA status: ${status.vaaStatus}`); |
Template literal with variable interpolation in command context
| 153 | console.log(`Redeemed: ${status.redeemed}`); |
Template literal with variable interpolation in command context
| 156 | console.log(`Ready to redeem! VAA: ${status.vaa}`); |
Template literal with variable interpolation in command context
| 171 | console.log(`${p.sourceChain} → ${p.destChain}`); |
Template literal with variable interpolation in command context
| 172 | console.log(` Amount: ${p.amount} ${p.token}`); |
Template literal with variable interpolation in command context
| 173 | console.log(` Status: ${p.status}`); |
Template literal with variable interpolation in command context
| 174 | console.log(` Age: ${p.age} minutes`); |
Access to .env file
| 91 | sourcePrivateKey: process.env.SOLANA_PRIVATE_KEY, |
Access to .env file
| 105 | destPrivateKey: process.env.EVM_PRIVATE_KEY, |
Access to .env file
| 123 | sourcePrivateKey: process.env.EVM_PRIVATE_KEY, |
Access to .env file
| 137 | destPrivateKey: process.env.EVM_PRIVATE_KEY, |