{"data":{"skill":{"slug":"blockrunai-nano-banana-blockrun","name":"nano-banana-blockrun","icon":"📦","repo":"https://github.com/BlockRunAI/nano-banana-blockrun/tree/main/","status":"approved","author":"BlockRunAI","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"de3155ef-7ac5-4768-a16d-3f718f4ca244","skill_id":"e42aa2bf-8b9d-4ce5-bff9-a88bbb17ea37","version":8,"content_hash":"v2:1b5b6c4962b2ad5a7a34603cab2685bbbd1b61ef:0027ccef3a29600c6846cddf5f5abd1eb115b15fc1caa3587fad617dc3fc8506:7ddb082bbec3930025acc9742dff728483c51969f83626af3eb5ccb95e6b027b:d7bcc38538b84791a81dd6a64af903ae","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"The audit found no prompt injection text, but the skill has real high-impact secret and payment risks. Several static hits were Markdown or license false positives, while private-key setup, .env usage, external SDK execution, and paid BlockRun API calls remain confirmed concerns.","remediation":[{"issue":"The skill requires users to configure a raw wallet private key.","severity":"high","suggestion":"Support a safer wallet flow, hardware signing, delegated keys, or a dedicated low-balance wallet with documented spend limits."},{"issue":"Paid image generation can be triggered through natural language requests.","severity":"high","suggestion":"Require explicit user confirmation before each paid request and display model, price, network, and wallet balance impact."},{"issue":"The setup installs blockrun-llm without pinning or verification.","severity":"medium","suggestion":"Pin a reviewed package version and document hash verification or a trusted lockfile for the payment SDK."},{"issue":"The documentation references scripts/generate.py, but the script is absent from scanned files.","severity":"low","suggestion":"Add the referenced script or remove the command examples so users do not run unverifiable paths."}],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":".env.example","line_end":7,"line_start":7},{"file":"LICENSE","line_end":3,"line_start":3},{"file":"LICENSE","line_end":184,"line_start":184},{"file":"README.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":67,"line_start":67},{"file":"SKILL.md","line_end":84,"line_start":84},{"file":"SKILL.md","line_end":85,"line_start":85},{"file":"SKILL.md","line_end":86,"line_start":86}]},{"factor":"filesystem","evidence":[{"file":"README.md","line_end":20,"line_start":20},{"file":"README.md","line_end":20,"line_start":20}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":17,"line_start":15},{"file":"SKILL.md","line_end":25,"line_start":17},{"file":"SKILL.md","line_end":31,"line_start":25},{"file":"SKILL.md","line_end":38,"line_start":31},{"file":"SKILL.md","line_end":44,"line_start":38},{"file":"SKILL.md","line_end":47,"line_start":44},{"file":"SKILL.md","line_end":55,"line_start":47},{"file":"SKILL.md","line_end":61,"line_start":55},{"file":"SKILL.md","line_end":62,"line_start":61},{"file":"SKILL.md","line_end":63,"line_start":62}]}],"critical_findings":[],"high_findings":[{"title":"Crypto seed/private key mention","locations":[{"file":".env.example","line_end":2,"line_start":2}],"confidence":0.9,"description":"# Your EVM wallet private key (with 0x prefix)","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The template explicitly asks for an EVM wallet private key. No real key is present, but the required setup handles a secret that can authorize spending."},{"title":"Environment file access","locations":[{"file":"README.md","line_end":38,"line_start":38}],"confidence":0.86,"description":"cp .env.example .env","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The README instructs users to create a .env file for wallet configuration. That file is intended to hold a private key used for payments."},{"title":"Environment file access","locations":[{"file":"README.md","line_end":40,"line_start":40}],"confidence":0.9,"description":"# Edit .env and add your private key","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The README instructs users to edit .env and add a private key. This creates a local secret file that could be exposed to other tools or agents."},{"title":"Crypto seed/private key mention","locations":[{"file":"README.md","line_end":40,"line_start":40}],"confidence":0.91,"description":"# Edit .env and add your private key","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The line directly asks the user to add a wallet private key. Compromise of that key can authorize crypto transfers or paid requests."},{"title":"Crypto seed/private key mention","locations":[{"file":"README.md","line_end":102,"line_start":102}],"confidence":0.78,"description":"**Your private key NEVER leaves your machine.**","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The line is a safety claim, but it confirms the skill depends on handling a wallet private key. The secret-handling risk remains even without evidence of exfiltration."},{"title":"Environment file access","locations":[{"file":"SKILL.md","line_end":26,"line_start":26}],"confidence":0.88,"description":"# Copy .env.example to .env and add your key","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The setup tells users to copy .env.example to .env and add a wallet key. This creates a local file containing a high-value secret."},{"title":"Environment file access","locations":[{"file":"SKILL.md","line_end":27,"line_start":27}],"confidence":0.86,"description":"cp .env.example .env","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The command creates the .env file used for wallet credentials. That file may be readable by local tools if permissions are not controlled."},{"title":"Crypto seed/private key mention","locations":[{"file":"SKILL.md","line_end":24,"line_start":24}],"confidence":0.93,"description":"3. Set your wallet private key:","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The skill requires setting a wallet private key. This is sensitive because the key can authorize payments or asset transfers."},{"title":"Crypto seed/private key mention","locations":[{"file":"SKILL.md","line_end":77,"line_start":77}],"confidence":0.8,"description":"**Your private key NEVER leaves your machine.**","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The line is a security assurance, but it confirms private-key handling is part of the workflow. The risk is secret exposure or misuse by the SDK or local environment."},{"title":"Autonomous Crypto Spending Risk","locations":[{"file":"README.md","line_end":56,"line_start":53},{"file":"README.md","line_end":96,"line_start":92},{"file":"SKILL.md","line_end":70,"line_start":67}],"confidence":0.91,"description":"The skill can let an AI assistant trigger paid image generation through a wallet-backed x402 flow. Without explicit confirmations or spend limits, repeated requests could consume user funds.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The README says Claude will use the skill automatically, and both README and SKILL.md describe paid signing and image generation. This directly supports the spending-risk assessment."}],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":17,"line_start":15}],"confidence":0.67,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The static label is imprecise, but the fenced block instructs users or agents to run pip install blockrun-llm. Installing an unpinned package is external code execution risk."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":31,"line_start":25}],"confidence":0.62,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced shell block includes commands to create .env and export BLOCKRUN_WALLET_KEY. The commands are simple, but they operationalize sensitive wallet-key handling."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":44,"line_start":38}],"confidence":0.66,"description":"```python","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The Python example imports the external SDK and calls image generation. If executed, it can trigger a network call and a paid request."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":55,"line_start":47}],"confidence":0.55,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced shell block tells users to run python scripts/generate.py. The referenced script is not present in the scanned files, so the execution path cannot be verified."},{"title":"Unpinned Payment SDK Installation","locations":[{"file":"README.md","line_end":28,"line_start":25},{"file":"SKILL.md","line_end":17,"line_start":14}],"confidence":0.84,"description":"The setup installs blockrun-llm without a version pin or hash verification. That package controls image requests and local payment signing, so supply-chain compromise has higher impact.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"Both setup sections use pip install blockrun-llm without a version or hash. The same files explain that the SDK signs payment data locally."}],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":67,"line_start":67}],"confidence":0.88,"description":"1. Your request goes to BlockRun API (https://blockrun.ai)","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The skill explicitly routes user image prompts to the BlockRun API. That is intended behavior, but it is real external network disclosure of prompt content and payment metadata."},{"title":"Unscanned file (binary) — manual review required","locations":[{"file":"example_image.png","line_end":1,"line_start":1}],"confidence":1,"description":"[unscanned: binary]","review_kind":"security","source_category":"metadata","source_severity":"low","confidence_reasoning":"Force-confirmed metadata/low static finding; AI false-positive verdict rejected."}],"dangerous_patterns":[],"files_scanned":5,"total_lines":421,"audit_model":"codex","audited_at":"2026-07-07T20:54:56.843+00:00","created_at":"2026-07-08T00:40:18.640034+00:00","static_findings":[{"id":"network:.env.example:7:hardcoded-url","file":".env.example","pattern":"Hardcoded URL","snippet":"# Get USDC on Base: https://bridge.base.org or buy on Coinbase","category":"network","line_end":7,"severity":"low","line_start":7},{"id":"sensitive:.env.example:2:crypto-seed-private-key-mention","file":".env.example","pattern":"Crypto seed/private key mention","snippet":"# Your EVM wallet private key (with 0x prefix)","category":"sensitive","line_end":2,"severity":"high","line_start":2},{"id":"sensitive:.gitignore:2:environment-file-access","file":".gitignore","pattern":"Environment file access","snippet":".env","category":"sensitive","line_end":2,"severity":"high","line_start":2},{"id":"sensitive:.gitignore:3:environment-file-access","file":".gitignore","pattern":"Environment file access","snippet":".env.local","category":"sensitive","line_end":3,"severity":"high","line_start":3},{"id":"sensitive:.gitignore:3:environment-variant-files","file":".gitignore","pattern":"Environment variant files","snippet":".env.local","category":"sensitive","line_end":3,"severity":"high","line_start":3},{"id":"sensitive:.gitignore:1:crypto-seed-private-key-mention","file":".gitignore","pattern":"Crypto seed/private key mention","snippet":"# Environment files (contain private keys!)","category":"sensitive","line_end":1,"severity":"high","line_start":1},{"id":"network:LICENSE:3:hardcoded-url","file":"LICENSE","pattern":"Hardcoded URL","snippet":"http://www.apache.org/licenses/","category":"network","line_end":3,"severity":"low","line_start":3},{"id":"network:LICENSE:184:hardcoded-url","file":"LICENSE","pattern":"Hardcoded URL","snippet":"http://www.apache.org/licenses/LICENSE-2.0","category":"network","line_end":184,"severity":"low","line_start":184},{"id":"network:README.md:20:hardcoded-url","file":"README.md","pattern":"Hardcoded URL","snippet":"git clone https://github.com/BlockRunAI/nano-banana-blockrun.git ~/.claude/skills/nano-banana-blockr","category":"network","line_end":20,"severity":"low","line_start":20},{"id":"filesystem:README.md:20:hidden-file-in-home-directory","file":"README.md","pattern":"Hidden file in home directory","snippet":"git clone https://github.com/BlockRunAI/nano-banana-blockrun.git ~/.claude/skills/nano-banana-blockr","category":"filesystem","line_end":20,"severity":"high","line_start":20},{"id":"filesystem:README.md:20:hidden-file-access","file":"README.md","pattern":"Hidden file access","snippet":"git clone https://github.com/BlockRunAI/nano-banana-blockrun.git ~/.claude/skills/nano-banana-blockr","category":"filesystem","line_end":20,"severity":"medium","line_start":20},{"id":"sensitive:README.md:38:environment-file-access","file":"README.md","pattern":"Environment file access","snippet":"cp .env.example .env","category":"sensitive","line_end":38,"severity":"high","line_start":38},{"id":"sensitive:README.md:40:environment-file-access","file":"README.md","pattern":"Environment file access","snippet":"# Edit .env and add your private key","category":"sensitive","line_end":40,"severity":"high","line_start":40},{"id":"sensitive:README.md:40:crypto-seed-private-key-mention","file":"README.md","pattern":"Crypto seed/private key mention","snippet":"# Edit .env and add your private key","category":"sensitive","line_end":40,"severity":"high","line_start":40},{"id":"sensitive:README.md:102:crypto-seed-private-key-mention","file":"README.md","pattern":"Crypto seed/private key mention","snippet":"**Your private key NEVER leaves your machine.**","category":"sensitive","line_end":102,"severity":"high","line_start":102},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":17,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":25,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":31,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":38,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```python","category":"external_commands","line_end":44,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":47,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":55,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":61,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `google/nano-banana` | ~$0.05 | 1024x1024 |","category":"external_commands","line_end":62,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `google/nano-banana-pro` | ~$0.10 | up to 4K |","category":"external_commands","line_end":63,"severity":"medium","line_start":62},{"id":"network:SKILL.md:20:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Bridge from Ethereum: https://bridge.base.org","category":"network","line_end":20,"severity":"low","line_start":20},{"id":"network:SKILL.md:67:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"1. Your request goes to BlockRun API (https://blockrun.ai)","category":"network","line_end":67,"severity":"low","line_start":67},{"id":"network:SKILL.md:84:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [BlockRun](https://blockrun.ai)","category":"network","line_end":84,"severity":"low","line_start":84},{"id":"network:SKILL.md:85:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [x402 Protocol](https://x402.org)","category":"network","line_end":85,"severity":"low","line_start":85},{"id":"network:SKILL.md:86:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- [PyPI Package](https://pypi.org/project/blockrun-llm/)","category":"network","line_end":86,"severity":"low","line_start":86},{"id":"sensitive:SKILL.md:26:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"# Copy .env.example to .env and add your key","category":"sensitive","line_end":26,"severity":"high","line_start":26},{"id":"sensitive:SKILL.md:27:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"cp .env.example .env","category":"sensitive","line_end":27,"severity":"high","line_start":27},{"id":"sensitive:SKILL.md:24:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"3. Set your wallet private key:","category":"sensitive","line_end":24,"severity":"high","line_start":24},{"id":"sensitive:SKILL.md:77:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"**Your private key NEVER leaves your machine.**","category":"sensitive","line_end":77,"severity":"high","line_start":77},{"id":"metadata:example_image.png:1:unscanned-file-binary-manual-review-required","file":"example_image.png","pattern":"Unscanned file (binary) — manual review required","snippet":"[unscanned: binary]","category":"metadata","line_end":1,"severity":"low","line_start":1}],"finding_verdicts":[{"id":"network:.env.example:7:hardcoded-url","reason":"This is a documentation link to the Base bridge for obtaining USDC. It is not executable code and does not send data by itself.","verdict":"false_positive","confidence":0.86},{"id":"sensitive:.env.example:2:crypto-seed-private-key-mention","reason":"The template explicitly asks for an EVM wallet private key. No real key is present, but the required setup handles a secret that can authorize spending.","verdict":"confirmed","severity":"high","confidence":0.9},{"id":"sensitive:.gitignore:2:environment-file-access","reason":"The .gitignore entry excludes .env from version control. This is a protective pattern, not environment-file access by the skill.","verdict":"false_positive","confidence":0.93},{"id":"sensitive:.gitignore:3:environment-file-access","reason":"The .gitignore entry excludes .env.local from version control. This reduces accidental secret disclosure rather than accessing secrets.","verdict":"false_positive","confidence":0.93},{"id":"sensitive:.gitignore:3:environment-variant-files","reason":"The environment variant appears only as an ignore rule. It is not loaded, read, or transmitted by repository code.","verdict":"false_positive","confidence":0.92},{"id":"sensitive:.gitignore:1:crypto-seed-private-key-mention","reason":"The line warns that ignored environment files contain private keys. It is a defensive comment, not a request to expose or read a key.","verdict":"false_positive","confidence":0.88},{"id":"network:LICENSE:3:hardcoded-url","reason":"This is the standard Apache License URL in the license text. It is not part of skill execution or data transfer.","verdict":"false_positive","confidence":0.98},{"id":"network:LICENSE:184:hardcoded-url","reason":"This is the standard Apache License URL in the license appendix. It has no operational network behavior.","verdict":"false_positive","confidence":0.98},{"id":"network:README.md:20:hardcoded-url","reason":"The URL appears in a git clone installation command for this repository. It is expected documentation and does not exfiltrate user data.","verdict":"false_positive","confidence":0.85},{"id":"filesystem:README.md:20:hidden-file-in-home-directory","reason":"The path is the documented Claude Code skills directory under ~/.claude. It is an expected installation target, not hidden-file snooping.","verdict":"false_positive","confidence":0.82},{"id":"filesystem:README.md:20:hidden-file-access","reason":"The hidden path is only used as the skill installation destination. No evidence shows unauthorized reading or modification of other hidden files.","verdict":"false_positive","confidence":0.82},{"id":"sensitive:README.md:38:environment-file-access","reason":"The README instructs users to create a .env file for wallet configuration. That file is intended to hold a private key used for payments.","verdict":"confirmed","severity":"high","confidence":0.86},{"id":"sensitive:README.md:40:environment-file-access","reason":"The README instructs users to edit .env and add a private key. This creates a local secret file that could be exposed to other tools or agents.","verdict":"confirmed","severity":"high","confidence":0.9},{"id":"sensitive:README.md:40:crypto-seed-private-key-mention","reason":"The line directly asks the user to add a wallet private key. Compromise of that key can authorize crypto transfers or paid requests.","verdict":"confirmed","severity":"high","confidence":0.91},{"id":"sensitive:README.md:102:crypto-seed-private-key-mention","reason":"The line is a safety claim, but it confirms the skill depends on handling a wallet private key. The secret-handling risk remains even without evidence of exfiltration.","verdict":"confirmed","severity":"high","confidence":0.78},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The static label is imprecise, but the fenced block instructs users or agents to run pip install blockrun-llm. Installing an unpinned package is external code execution risk.","verdict":"confirmed","severity":"medium","confidence":0.67},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"This finding points at Markdown fence structure rather than an executable command. The surrounding setup text is addressed by separate findings.","verdict":"false_positive","confidence":0.74},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The fenced shell block includes commands to create .env and export BLOCKRUN_WALLET_KEY. The commands are simple, but they operationalize sensitive wallet-key handling.","verdict":"confirmed","severity":"medium","confidence":0.62},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"This finding lands on the closing Markdown fence and nearby prose. It does not identify a Ruby backtick execution construct or command injection vector.","verdict":"false_positive","confidence":0.78},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The Python example imports the external SDK and calls image generation. If executed, it can trigger a network call and a paid request.","verdict":"confirmed","severity":"medium","confidence":0.66},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"This finding points to Markdown fence closure and prose. It does not contain a command execution primitive by itself.","verdict":"false_positive","confidence":0.78},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"The fenced shell block tells users to run python scripts/generate.py. The referenced script is not present in the scanned files, so the execution path cannot be verified.","verdict":"confirmed","severity":"medium","confidence":0.55},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"This finding is on a Markdown fence boundary before a model table. It does not represent executable shell or Ruby code.","verdict":"false_positive","confidence":0.8},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"The backticks mark a model name in a Markdown table. There is no command execution behavior at this location.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The backticks mark a model name in a Markdown table. This is formatting, not code execution.","verdict":"false_positive","confidence":0.94},{"id":"network:SKILL.md:20:hardcoded-url","reason":"This is a documentation link to a bridge for funding Base USDC. It is not executable network logic inside the skill.","verdict":"false_positive","confidence":0.84},{"id":"network:SKILL.md:67:hardcoded-url","reason":"The skill explicitly routes user image prompts to the BlockRun API. That is intended behavior, but it is real external network disclosure of prompt content and payment metadata.","verdict":"confirmed","severity":"low","confidence":0.88},{"id":"network:SKILL.md:84:hardcoded-url","reason":"This is a reference link in the Links section. It does not execute a request or transmit user data.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:85:hardcoded-url","reason":"This is a reference link to x402 documentation. It is informational and not part of runtime behavior.","verdict":"false_positive","confidence":0.88},{"id":"network:SKILL.md:86:hardcoded-url","reason":"This is a PyPI package link in documentation. The install risk is covered by the pip installation finding, not the URL itself.","verdict":"false_positive","confidence":0.86},{"id":"sensitive:SKILL.md:26:environment-file-access","reason":"The setup tells users to copy .env.example to .env and add a wallet key. This creates a local file containing a high-value secret.","verdict":"confirmed","severity":"high","confidence":0.88},{"id":"sensitive:SKILL.md:27:environment-file-access","reason":"The command creates the .env file used for wallet credentials. That file may be readable by local tools if permissions are not controlled.","verdict":"confirmed","severity":"high","confidence":0.86},{"id":"sensitive:SKILL.md:24:crypto-seed-private-key-mention","reason":"The skill requires setting a wallet private key. This is sensitive because the key can authorize payments or asset transfers.","verdict":"confirmed","severity":"high","confidence":0.93},{"id":"sensitive:SKILL.md:77:crypto-seed-private-key-mention","reason":"The line is a security assurance, but it confirms private-key handling is part of the workflow. The risk is secret exposure or misuse by the SDK or local environment.","verdict":"confirmed","severity":"high","confidence":0.8},{"id":"metadata:example_image.png:1:unscanned-file-binary-manual-review-required","reason":"Manual inspection identified the file as a PNG image used by the README example. No evidence found that it is executable or referenced as code.","verdict":"false_positive","confidence":0.74}],"semantic_findings":[{"title":"Autonomous Crypto Spending Risk","severity":"high","locations":[{"file":"README.md","line_end":56,"line_start":53},{"file":"README.md","line_end":96,"line_start":92},{"file":"SKILL.md","line_end":70,"line_start":67}],"confidence":0.91,"description":"The skill can let an AI assistant trigger paid image generation through a wallet-backed x402 flow. Without explicit confirmations or spend limits, repeated requests could consume user funds.","confidence_reasoning":"The README says Claude will use the skill automatically, and both README and SKILL.md describe paid signing and image generation. This directly supports the spending-risk assessment."},{"title":"Unpinned Payment SDK Installation","severity":"medium","locations":[{"file":"README.md","line_end":28,"line_start":25},{"file":"SKILL.md","line_end":17,"line_start":14}],"confidence":0.84,"description":"The setup installs blockrun-llm without a version pin or hash verification. That package controls image requests and local payment signing, so supply-chain compromise has higher impact.","confidence_reasoning":"Both setup sections use pip install blockrun-llm without a version or hash. The same files explain that the SDK signs payment data locally."}],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":11,"capabilityReviewCount":5,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}