{"data":{"skill":{"slug":"internet-court-alkahest-user","name":"alkahest-user","icon":"📦","repo":"https://github.com/internet-court/internet-court-skill/tree/main/vendored/arkhai/alkahest-user","status":"approved","author":"internet-court","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"8987eb29-cedc-4da8-8be7-65340b233ee6","skill_id":"1bb6e606-33af-44d1-86c3-dc310ffd3f8b","version":2,"content_hash":"v3:3f6e026a3363e0954ede7bef0cfe88d4475de137:dbee5b852ac362dda828c661c70b8f052c9b2003343bb806a49bc57449063623:b52624ea5b24ec1883b2085bdf3480b9f0e612bc976be3d7cf90e6f379666d49:736b696c6c732f696e7465726e65742d636f7572742f616c6b61686573742d75736572:4b960d5269b040d382d5c6045ac02bb7","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"Most static findings are false positives caused by Markdown backticks, placeholder examples, and blockchain identifiers. The skill documents unsafe wallet-secret delivery through CLI arguments and environment variables, and it lacks safety checks for irreversible asset operations. Review is required before publication.","remediation":[{"issue":"Wallet secrets are shown in CLI arguments and environment variables.","severity":"high","suggestion":"Prefer hardware wallets or an external signer. Remove private-key and mnemonic command examples, and document secure secret storage when an automated signer is unavoidable."},{"issue":"Asset-moving examples omit pre-transaction verification.","severity":"high","suggestion":"Add mandatory steps to verify chain ID, contract and token addresses, amounts, expiration, spender approval, and transaction simulation before signing."},{"issue":"Examples use automatic token approval without allowance guidance.","severity":"high","suggestion":"Explain the approved spender and allowance scope. Prefer exact, limited allowances and direct users to revoke unused approvals."},{"issue":"Custom RPC endpoints are accepted without trust guidance.","severity":"medium","suggestion":"Tell users to use trusted RPC providers and avoid endpoints that can observe sensitive transaction metadata."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"references/typescript-sdk.md","line_end":116,"line_start":113},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":34,"line_start":32},{"file":"SKILL.md","line_end":42,"line_start":34},{"file":"SKILL.md","line_end":43,"line_start":42},{"file":"SKILL.md","line_end":44,"line_start":43},{"file":"SKILL.md","line_end":45,"line_start":44},{"file":"SKILL.md","line_end":46,"line_start":45},{"file":"SKILL.md","line_end":47,"line_start":46},{"file":"SKILL.md","line_end":51,"line_start":47},{"file":"SKILL.md","line_end":55,"line_start":51},{"file":"SKILL.md","line_end":61,"line_start":55},{"file":"SKILL.md","line_end":64,"line_start":61},{"file":"SKILL.md","line_end":66,"line_start":64},{"file":"SKILL.md","line_end":74,"line_start":66},{"file":"SKILL.md","line_end":81,"line_start":74},{"file":"SKILL.md","line_end":85,"line_start":81},{"file":"SKILL.md","line_end":85,"line_start":85},{"file":"SKILL.md","line_end":117,"line_start":87},{"file":"SKILL.md","line_end":119,"line_start":117},{"file":"SKILL.md","line_end":119,"line_start":119},{"file":"SKILL.md","line_end":127,"line_start":123},{"file":"SKILL.md","line_end":131,"line_start":127},{"file":"SKILL.md","line_end":134,"line_start":131},{"file":"SKILL.md","line_end":138,"line_start":134},{"file":"SKILL.md","line_end":141,"line_start":138},{"file":"SKILL.md","line_end":147,"line_start":141},{"file":"SKILL.md","line_end":165,"line_start":147},{"file":"SKILL.md","line_end":169,"line_start":165},{"file":"SKILL.md","line_end":183,"line_start":169},{"file":"SKILL.md","line_end":185,"line_start":183},{"file":"SKILL.md","line_end":185,"line_start":185},{"file":"SKILL.md","line_end":201,"line_start":189},{"file":"SKILL.md","line_end":203,"line_start":201},{"file":"SKILL.md","line_end":209,"line_start":203},{"file":"SKILL.md","line_end":238,"line_start":209},{"file":"SKILL.md","line_end":242,"line_start":238},{"file":"SKILL.md","line_end":244,"line_start":242},{"file":"SKILL.md","line_end":261,"line_start":244},{"file":"SKILL.md","line_end":263,"line_start":261},{"file":"SKILL.md","line_end":263,"line_start":263},{"file":"SKILL.md","line_end":271,"line_start":267},{"file":"SKILL.md","line_end":277,"line_start":271},{"file":"SKILL.md","line_end":289,"line_start":277},{"file":"SKILL.md","line_end":291,"line_start":289},{"file":"SKILL.md","line_end":291,"line_start":291},{"file":"SKILL.md","line_end":312,"line_start":295},{"file":"SKILL.md","line_end":316,"line_start":312},{"file":"SKILL.md","line_end":323,"line_start":316},{"file":"SKILL.md","line_end":325,"line_start":323}]},{"factor":"network","evidence":[{"file":"references/typescript-sdk.md","line_end":16,"line_start":16}]},{"factor":"env_access","evidence":[{"file":"references/typescript-sdk.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":47,"line_start":47}]}],"critical_findings":[],"high_findings":[{"title":"Generic API/secret keys","locations":[{"file":"SKILL.md","line_end":45,"line_start":45}],"confidence":0.91,"description":"| Private key env | `ALKAHEST_PRIVATE_KEY=0x...` |","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The documentation recommends supplying wallet private keys or mnemonics through CLI arguments or environment variables. CLI arguments can be retained in shell history or exposed to local process inspection, and environment variables can leak to child processes."},{"title":"Generic API/secret keys","locations":[{"file":"SKILL.md","line_end":47,"line_start":47}],"confidence":0.91,"description":"| Compat env | `PRIVATE_KEY=0x...` |","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The documentation recommends supplying wallet private keys or mnemonics through CLI arguments or environment variables. CLI arguments can be retained in shell history or exposed to local process inspection, and environment variables can leak to child processes."},{"title":"Crypto seed/private key mention","locations":[{"file":"SKILL.md","line_end":42,"line_start":42}],"confidence":0.91,"description":"| Private key flag | `--private-key 0x...` |","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The documentation recommends supplying wallet private keys or mnemonics through CLI arguments or environment variables. CLI arguments can be retained in shell history or exposed to local process inspection, and environment variables can leak to child processes."},{"title":"Crypto seed/private key mention","locations":[{"file":"SKILL.md","line_end":43,"line_start":43}],"confidence":0.91,"description":"| Mnemonic flag | `--mnemonic \"word1 word2 ...\"` |","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The documentation recommends supplying wallet private keys or mnemonics through CLI arguments or environment variables. CLI arguments can be retained in shell history or exposed to local process inspection, and environment variables can leak to child processes."},{"title":"Crypto seed/private key mention","locations":[{"file":"SKILL.md","line_end":45,"line_start":45}],"confidence":0.91,"description":"| Private key env | `ALKAHEST_PRIVATE_KEY=0x...` |","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The documentation recommends supplying wallet private keys or mnemonics through CLI arguments or environment variables. CLI arguments can be retained in shell history or exposed to local process inspection, and environment variables can leak to child processes."},{"title":"Crypto seed/private key mention","locations":[{"file":"SKILL.md","line_end":46,"line_start":46}],"confidence":0.91,"description":"| Mnemonic env | `ALKAHEST_MNEMONIC=\"word1 word2 ...\"` |","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The documentation recommends supplying wallet private keys or mnemonics through CLI arguments or environment variables. CLI arguments can be retained in shell history or exposed to local process inspection, and environment variables can leak to child processes."},{"title":"Irreversible asset operations lack verification guidance","locations":[{"file":"SKILL.md","line_end":116,"line_start":87},{"file":"SKILL.md","line_end":182,"line_start":147},{"file":"SKILL.md","line_end":200,"line_start":189},{"file":"SKILL.md","line_end":237,"line_start":219}],"confidence":0.89,"description":"The workflow examples create escrows, approve token spending, collect assets, arbitrate, and slash bonds without requiring users to verify chain, contract addresses, token amounts, or transaction simulation before signing. Incorrect inputs can cause irreversible on-chain asset loss.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"These sections explicitly document signing asset-moving, approval, arbitration, and bond-slashing actions, but include no pre-signing verification or simulation step. The risk follows directly from the irreversible EVM transaction model."}],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":4,"total_lines":1007,"audit_model":"claude","audited_at":"2026-07-21T02:30:49.752+00:00","created_at":"2026-07-21T02:42:24.392015+00:00","static_findings":[{"id":"blocker:references/arbiters.md:92:system-reconnaissance","file":"references/arbiters.md","pattern":"System reconnaissance","snippet":"| `UidArbiter` | `{ uid: bytes32 }` | `attestation.uid == uid` |","category":"blocker","line_end":92,"severity":"low","line_start":92},{"id":"blocker:references/contracts.md:48:system-reconnaissance","file":"references/contracts.md","pattern":"System reconnaissance","snippet":"- `reclaimBond(fulfillmentUid)` — reclaim bond after valid reveal","category":"blocker","line_end":48,"severity":"low","line_start":48},{"id":"external_commands:references/typescript-sdk.md:113:ruby-shell-backtick-execution","file":"references/typescript-sdk.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Arbitrated ${uid}: ${decision}`);","category":"external_commands","line_end":116,"severity":"medium","line_start":113},{"id":"network:references/typescript-sdk.md:16:hardcoded-url","file":"references/typescript-sdk.md","pattern":"Hardcoded URL","snippet":"transport: http(\"https://your-rpc-url\"),","category":"network","line_end":16,"severity":"low","line_start":16},{"id":"env_access:references/typescript-sdk.md:14:generic-api-secret-keys","file":"references/typescript-sdk.md","pattern":"Generic API/secret keys","snippet":"account: privateKeyToAccount(\"0xYOUR_PRIVATE_KEY\"),","category":"env_access","line_end":14,"severity":"high","line_start":14},{"id":"sensitive:references/typescript-sdk.md:9:crypto-seed-private-key-mention","file":"references/typescript-sdk.md","pattern":"Crypto seed/private key mention","snippet":"import { privateKeyToAccount } from \"viem/accounts\";","category":"sensitive","line_end":9,"severity":"high","line_start":9},{"id":"sensitive:references/typescript-sdk.md:14:crypto-seed-private-key-mention","file":"references/typescript-sdk.md","pattern":"Crypto seed/private key mention","snippet":"account: privateKeyToAccount(\"0xYOUR_PRIVATE_KEY\"),","category":"sensitive","line_end":14,"severity":"high","line_start":14},{"id":"blocker:references/typescript-sdk.md:58:system-reconnaissance","file":"references/typescript-sdk.md","pattern":"System reconnaissance","snippet":"const escrowUid = attested.uid;","category":"blocker","line_end":58,"severity":"low","line_start":58},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Install globally via `npm install -g alkahest-cli`, then run commands with:","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":34,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":42,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Private key flag | `--private-key 0x...` |","category":"external_commands","line_end":43,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Mnemonic flag | `--mnemonic \"word1 word2 ...\"` |","category":"external_commands","line_end":44,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Ledger USB | `--ledger [--ledger-path <path>]` |","category":"external_commands","line_end":45,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Private key env | `ALKAHEST_PRIVATE_KEY=0x...` |","category":"external_commands","line_end":46,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Mnemonic env | `ALKAHEST_MNEMONIC=\"word1 word2 ...\"` |","category":"external_commands","line_end":47,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Compat env | `PRIVATE_KEY=0x...` |","category":"external_commands","line_end":51,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":55,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":61,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```json","category":"external_commands","line_end":64,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":66,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use `--human` for labeled, indented output.","category":"external_commands","line_end":74,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":81,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":85,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Use the `--arbiter` address and the encoded `--demand` hex from step 1:","category":"external_commands","line_end":85,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":117,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":119,"severity":"medium","line_start":117},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Returns `{ \"success\": true, \"data\": { \"hash\": \"0x...\", \"uid\": \"0x...\", ... } }`. Save the `uid` — th","category":"external_commands","line_end":119,"severity":"medium","line_start":119},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":127,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":131,"severity":"medium","line_start":127},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":134,"severity":"medium","line_start":131},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":138,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":141,"severity":"medium","line_start":138},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":147,"severity":"medium","line_start":141},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":165,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":169,"severity":"medium","line_start":165},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":183,"severity":"medium","line_start":169},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":185,"severity":"medium","line_start":183},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Supported barter pairs: `erc20/erc20`, `erc20/erc721`, `erc20/erc1155`. `--permit` is only supported","category":"external_commands","line_end":185,"severity":"medium","line_start":185},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":201,"severity":"medium","line_start":189},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":203,"severity":"medium","line_start":201},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"For auto-arbitration (listening for requests and auto-deciding), use the TypeScript SDK directly — s","category":"external_commands","line_end":209,"severity":"medium","line_start":203},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":238,"severity":"medium","line_start":209},{"id":"external_commands:SKILL.md:238:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":242,"severity":"medium","line_start":238},{"id":"external_commands:SKILL.md:242:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The `arbiter encode-demand` command encodes demand data for any arbiter type:","category":"external_commands","line_end":244,"severity":"medium","line_start":242},{"id":"external_commands:SKILL.md:244:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":261,"severity":"medium","line_start":244},{"id":"external_commands:SKILL.md:261:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":263,"severity":"medium","line_start":261},{"id":"external_commands:SKILL.md:263:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Available `--type` values: `trusted-oracle`, `all`, `any`, `recipient`, `attester`, `schema`, `uid`,","category":"external_commands","line_end":263,"severity":"medium","line_start":263},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":271,"severity":"medium","line_start":267},{"id":"external_commands:SKILL.md:271:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":277,"severity":"medium","line_start":271},{"id":"external_commands:SKILL.md:277:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":289,"severity":"medium","line_start":277},{"id":"external_commands:SKILL.md:289:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":291,"severity":"medium","line_start":289},{"id":"external_commands:SKILL.md:291:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Types: `exclusive-revocable`, `exclusive-unrevocable`, `nonexclusive-revocable`, `nonexclusive-unrev","category":"external_commands","line_end":291,"severity":"medium","line_start":291},{"id":"external_commands:SKILL.md:295:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":312,"severity":"medium","line_start":295},{"id":"external_commands:SKILL.md:312:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":316,"severity":"medium","line_start":312},{"id":"external_commands:SKILL.md:316:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":323,"severity":"medium","line_start":316},{"id":"external_commands:SKILL.md:323:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":325,"severity":"medium","line_start":323},{"id":"external_commands:SKILL.md:325:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Decode types: `erc20-escrow`, `erc20-payment`, `erc721-escrow`, `erc721-payment`, `erc1155-escrow`, ","category":"external_commands","line_end":325,"severity":"medium","line_start":325},{"id":"external_commands:SKILL.md:329:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":335,"severity":"medium","line_start":329},{"id":"external_commands:SKILL.md:335:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":341,"severity":"medium","line_start":335},{"id":"external_commands:SKILL.md:341:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| ERC20 | `--erc20` | `--token`, `--amount` |","category":"external_commands","line_end":341,"severity":"medium","line_start":341},{"id":"external_commands:SKILL.md:342:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| ERC721 | `--erc721` | `--token`, `--token-id` |","category":"external_commands","line_end":342,"severity":"medium","line_start":342},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| ERC1155 | `--erc1155` | `--token`, `--token-id`, `--amount` |","category":"external_commands","line_end":343,"severity":"medium","line_start":343},{"id":"external_commands:SKILL.md:344:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Native Token | `--native` | `--amount` |","category":"external_commands","line_end":344,"severity":"medium","line_start":344},{"id":"external_commands:SKILL.md:345:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Token Bundle | `--bundle` | (SDK only for create) |","category":"external_commands","line_end":351,"severity":"medium","line_start":345},{"id":"external_commands:SKILL.md:351:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- See `references/typescript-sdk.md` for TypeScript SDK usage (complex workflows, auto-arbitration, ","category":"external_commands","line_end":352,"severity":"medium","line_start":351},{"id":"external_commands:SKILL.md:352:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- See `references/contracts.md` for all contract addresses and obligation data schemas","category":"external_commands","line_end":353,"severity":"medium","line_start":352},{"id":"env_access:SKILL.md:45:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"| Private key env | `ALKAHEST_PRIVATE_KEY=0x...` |","category":"env_access","line_end":45,"severity":"high","line_start":45},{"id":"env_access:SKILL.md:47:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"| Compat env | `PRIVATE_KEY=0x...` |","category":"env_access","line_end":47,"severity":"high","line_start":47},{"id":"sensitive:SKILL.md:42:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"| Private key flag | `--private-key 0x...` |","category":"sensitive","line_end":42,"severity":"high","line_start":42},{"id":"sensitive:SKILL.md:43:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"| Mnemonic flag | `--mnemonic \"word1 word2 ...\"` |","category":"sensitive","line_end":43,"severity":"high","line_start":43},{"id":"sensitive:SKILL.md:45:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"| Private key env | `ALKAHEST_PRIVATE_KEY=0x...` |","category":"sensitive","line_end":45,"severity":"high","line_start":45},{"id":"sensitive:SKILL.md:46:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"| Mnemonic env | `ALKAHEST_MNEMONIC=\"word1 word2 ...\"` |","category":"sensitive","line_end":46,"severity":"high","line_start":46},{"id":"blocker:SKILL.md:102:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--token-id 42 \\","category":"blocker","line_end":102,"severity":"low","line_start":102},{"id":"blocker:SKILL.md:125:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--erc20 --uid 0xESCROW_UID","category":"blocker","line_end":125,"severity":"low","line_start":125},{"id":"blocker:SKILL.md:133:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--erc20 --uid 0xESCROW_UID","category":"blocker","line_end":133,"severity":"low","line_start":133},{"id":"blocker:SKILL.md:140:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--erc20 --uid 0xESCROW_UID","category":"blocker","line_end":140,"severity":"low","line_start":140},{"id":"blocker:SKILL.md:151:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--ref-uid 0xESCROW_UID","category":"blocker","line_end":151,"severity":"low","line_start":151},{"id":"blocker:SKILL.md:163:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--escrow-uid 0xESCROW_UID \\","category":"blocker","line_end":163,"severity":"low","line_start":163},{"id":"blocker:SKILL.md:164:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--fulfillment-uid 0xFULFILLMENT_UID","category":"blocker","line_end":164,"severity":"low","line_start":164},{"id":"blocker:SKILL.md:170:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"# Create a barter offer: bid ERC20 for ERC20","category":"blocker","line_end":170,"severity":"low","line_start":170},{"id":"blocker:SKILL.md:180:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--uid 0xBARTER_UID \\","category":"blocker","line_end":180,"severity":"low","line_start":180},{"id":"blocker:SKILL.md:212:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--ref-uid 0xESCROW_UID \\","category":"blocker","line_end":212,"severity":"low","line_start":212},{"id":"blocker:SKILL.md:229:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--ref-uid 0xESCROW_UID","category":"blocker","line_end":229,"severity":"low","line_start":229},{"id":"blocker:SKILL.md:311:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"alkahest --private-key 0xKEY payment get --erc20 --uid 0xUID","category":"blocker","line_end":311,"severity":"low","line_start":311},{"id":"blocker:SKILL.md:318:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"alkahest --private-key 0xKEY attestation get --uid 0xUID","category":"blocker","line_end":318,"severity":"low","line_start":318},{"id":"blocker:SKILL.md:322:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--uid 0xUID --type erc20-escrow","category":"blocker","line_end":322,"severity":"low","line_start":322}],"finding_verdicts":[{"id":"blocker:references/arbiters.md:92:system-reconnaissance","reason":"The referenced value is an on-chain UID, token ID, or contract workflow field. It does not inspect the host system or perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/contracts.md:48:system-reconnaissance","reason":"The referenced value is an on-chain UID, token ID, or contract workflow field. It does not inspect the host system or perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:references/typescript-sdk.md:113:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"network:references/typescript-sdk.md:16:hardcoded-url","reason":"The URL is the literal placeholder \"https://your-rpc-url\" in a TypeScript setup example. It does not make a network request or identify an external endpoint.","verdict":"false_positive","confidence":0.98},{"id":"env_access:references/typescript-sdk.md:14:generic-api-secret-keys","reason":"The code sample uses the literal placeholder \"0xYOUR_PRIVATE_KEY\". No credential is embedded, read from the environment, or transmitted by the skill.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/typescript-sdk.md:9:crypto-seed-private-key-mention","reason":"This is an import of a wallet helper in a TypeScript documentation example. It contains no secret material and does not access a key.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/typescript-sdk.md:14:crypto-seed-private-key-mention","reason":"The sample contains the literal placeholder \"0xYOUR_PRIVATE_KEY\", not a private key. No secret is present in the skill.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/typescript-sdk.md:58:system-reconnaissance","reason":"The referenced value is an on-chain UID, token ID, or contract workflow field. It does not inspect the host system or perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:127:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:138:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:165:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:169:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:189:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:238:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:242:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:244:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:261:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:263:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:271:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:277:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:289:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:291:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:295:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:312:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:316:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:323:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:325:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:329:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:335:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:341:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:342:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:344:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:345:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:351:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:352:ruby-shell-backtick-execution","reason":"This is Markdown syntax or a documented CLI invocation, not Ruby or shell backtick execution. The skill contains no executable shell code at this location.","verdict":"false_positive","confidence":0.98},{"id":"env_access:SKILL.md:45:generic-api-secret-keys","reason":"The documentation recommends supplying wallet private keys or mnemonics through CLI arguments or environment variables. CLI arguments can be retained in shell history or exposed to local process inspection, and environment variables can leak to child processes.","verdict":"confirmed","severity":"high","confidence":0.91},{"id":"env_access:SKILL.md:47:generic-api-secret-keys","reason":"The documentation recommends supplying wallet private keys or mnemonics through CLI arguments or environment variables. CLI arguments can be retained in shell history or exposed to local process inspection, and environment variables can leak to child processes.","verdict":"confirmed","severity":"high","confidence":0.91},{"id":"sensitive:SKILL.md:42:crypto-seed-private-key-mention","reason":"The documentation recommends supplying wallet private keys or mnemonics through CLI arguments or environment variables. CLI arguments can be retained in shell history or exposed to local process inspection, and environment variables can leak to child processes.","verdict":"confirmed","severity":"high","confidence":0.91},{"id":"sensitive:SKILL.md:43:crypto-seed-private-key-mention","reason":"The documentation recommends supplying wallet private keys or mnemonics through CLI arguments or environment variables. CLI arguments can be retained in shell history or exposed to local process inspection, and environment variables can leak to child processes.","verdict":"confirmed","severity":"high","confidence":0.91},{"id":"sensitive:SKILL.md:45:crypto-seed-private-key-mention","reason":"The documentation recommends supplying wallet private keys or mnemonics through CLI arguments or environment variables. CLI arguments can be retained in shell history or exposed to local process inspection, and environment variables can leak to child processes.","verdict":"confirmed","severity":"high","confidence":0.91},{"id":"sensitive:SKILL.md:46:crypto-seed-private-key-mention","reason":"The documentation recommends supplying wallet private keys or mnemonics through CLI arguments or environment variables. CLI arguments can be retained in shell history or exposed to local process inspection, and environment variables can leak to child processes.","verdict":"confirmed","severity":"high","confidence":0.91},{"id":"blocker:SKILL.md:102:system-reconnaissance","reason":"The referenced value is an on-chain UID, token ID, or contract workflow field. It does not inspect the host system or perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:125:system-reconnaissance","reason":"The referenced value is an on-chain UID, token ID, or contract workflow field. It does not inspect the host system or perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:133:system-reconnaissance","reason":"The referenced value is an on-chain UID, token ID, or contract workflow field. It does not inspect the host system or perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:140:system-reconnaissance","reason":"The referenced value is an on-chain UID, token ID, or contract workflow field. It does not inspect the host system or perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:151:system-reconnaissance","reason":"The referenced value is an on-chain UID, token ID, or contract workflow field. It does not inspect the host system or perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:163:system-reconnaissance","reason":"The referenced value is an on-chain UID, token ID, or contract workflow field. It does not inspect the host system or perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:164:system-reconnaissance","reason":"The referenced value is an on-chain UID, token ID, or contract workflow field. It does not inspect the host system or perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:170:system-reconnaissance","reason":"The referenced value is an on-chain UID, token ID, or contract workflow field. It does not inspect the host system or perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:180:system-reconnaissance","reason":"The referenced value is an on-chain UID, token ID, or contract workflow field. It does not inspect the host system or perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:212:system-reconnaissance","reason":"The referenced value is an on-chain UID, token ID, or contract workflow field. It does not inspect the host system or perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:229:system-reconnaissance","reason":"The referenced value is an on-chain UID, token ID, or contract workflow field. It does not inspect the host system or perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:311:system-reconnaissance","reason":"The referenced value is an on-chain UID, token ID, or contract workflow field. It does not inspect the host system or perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:318:system-reconnaissance","reason":"The referenced value is an on-chain UID, token ID, or contract workflow field. It does not inspect the host system or perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:322:system-reconnaissance","reason":"The referenced value is an on-chain UID, token ID, or contract workflow field. It does not inspect the host system or perform system reconnaissance.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[{"title":"Irreversible asset operations lack verification guidance","severity":"high","locations":[{"file":"SKILL.md","line_end":116,"line_start":87},{"file":"SKILL.md","line_end":182,"line_start":147},{"file":"SKILL.md","line_end":200,"line_start":189},{"file":"SKILL.md","line_end":237,"line_start":219}],"confidence":0.89,"description":"The workflow examples create escrows, approve token spending, collect assets, arbitrate, and slash bonds without requiring users to verify chain, contract addresses, token amounts, or transaction simulation before signing. Incorrect inputs can cause irreversible on-chain asset loss.","confidence_reasoning":"These sections explicitly document signing asset-moving, approval, arbitration, and bond-slashing actions, but include no pre-signing verification or simulation step. The risk follows directly from the irreversible EVM transaction model."}],"subject_marketplace_commit_sha":"3f6e026a3363e0954ede7bef0cfe88d4475de137","subject_content_hash":"dbee5b852ac362dda828c661c70b8f052c9b2003343bb806a49bc57449063623","subject_tree_hash":"b52624ea5b24ec1883b2085bdf3480b9f0e612bc976be3d7cf90e6f379666d49","subject_plugin_path":"skills/internet-court/alkahest-user","audit_payload_hash":"4b960d5269b040d382d5c6045ac02bb7","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"3f6e026a3363e0954ede7bef0cfe88d4475de137","contentHash":"dbee5b852ac362dda828c661c70b8f052c9b2003343bb806a49bc57449063623","treeHash":"b52624ea5b24ec1883b2085bdf3480b9f0e612bc976be3d7cf90e6f379666d49","pluginPath":"skills/internet-court/alkahest-user","auditPayloadHash":"4b960d5269b040d382d5c6045ac02bb7"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"unavailable","url":null,"status":null},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":5,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"unavailable","verificationState":"not_verified"},"isLatest":true}}