fix(sushi): use parameterized GraphQL variables in findToken

[jayantkamble10000]

What

SushiDataActionProvider.findToken() builds its GraphQL request body by interpolating the user-provided args.search directly into the query string. This switches to a parameterized query using GraphQL variables (with JSON.stringify for the body).

Why

Interpolating search into the query string means special characters in the input can alter the GraphQL query structure rather than being treated purely as data — FindTokenSchema only enforces z.string().min(2), so quotes, braces, and GraphQL keywords pass through unescaped. Using variables makes the input always a value, never query syntax, and removes the manual JSON escaping.

Change

typescript/agentkit/src/action-providers/sushi/sushiDataActionProvider.ts — replace the string-interpolated body with a query FindToken($chainId: Int!, $search: String!) document plus variables: { chainId, search: args.search }. Behavior is unchanged for normal inputs and the returned shape is identical.

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1