{"data":{"skill":{"slug":"internet-court-fulfill-git-escrow","name":"fulfill-git-escrow","icon":"📦","repo":"https://github.com/internet-court/internet-court-skill/tree/main/vendored/arkhai/fulfill-git-escrow","status":"approved","author":"internet-court","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"8503f050-678c-471f-b072-722a56d5f99a","skill_id":"23cc83e9-5fd9-46ae-8d76-4587eab4ccfb","version":1,"content_hash":"09d36b649f8b8a7d4bab0319ce82d4c6","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"The skill legitimately centers on shell and git-escrows CLI usage. Several markdown backtick hits are false positives, but command execution, escrow network operations, and secret handling are confirmed. The largest risks are PRIVATE_KEY-backed .env use, CLI private-key setup, and blockchain escrow actions without explicit confirmation. No prompt injection attempt was found in SKILL.md.","remediation":[{"issue":"Private key handling","severity":"high","suggestion":"Do not ask the model to inspect, receive, or echo private keys. Require user-managed wallet or CLI configuration outside the conversation."},{"issue":"Transaction confirmation","severity":"high","suggestion":"Require explicit user confirmation before running fulfill or collect commands that may sign or submit blockchain transactions."},{"issue":"Broad git staging","severity":"high","suggestion":"Replace git add -A with reviewed file-specific staging or require a staged diff review before committing."},{"issue":"Untrusted repository handling","severity":"medium","suggestion":"Clone test repositories into fresh unique directories and avoid running project scripts unless the user approves."},{"issue":"Dynamic package execution","severity":"medium","suggestion":"Prefer a pinned git-escrows installation over npx or bunx fallback execution from the network."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":44,"line_start":42},{"file":"SKILL.md","line_end":48,"line_start":44},{"file":"SKILL.md","line_end":52,"line_start":48},{"file":"SKILL.md","line_end":60,"line_start":52},{"file":"SKILL.md","line_end":71,"line_start":60},{"file":"SKILL.md","line_end":77,"line_start":71},{"file":"SKILL.md","line_end":78,"line_start":77},{"file":"SKILL.md","line_end":79,"line_start":78},{"file":"SKILL.md","line_end":84,"line_start":79},{"file":"SKILL.md","line_end":89,"line_start":84},{"file":"SKILL.md","line_end":96,"line_start":89},{"file":"SKILL.md","line_end":97,"line_start":96},{"file":"SKILL.md","line_end":103,"line_start":97},{"file":"SKILL.md","line_end":108,"line_start":103},{"file":"SKILL.md","line_end":116,"line_start":108},{"file":"SKILL.md","line_end":118,"line_start":116},{"file":"SKILL.md","line_end":119,"line_start":118},{"file":"SKILL.md","line_end":121,"line_start":119}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":17,"line_start":17}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":60,"line_start":60}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":4,"line_start":4},{"file":"SKILL.md","line_end":16,"line_start":16}]}],"critical_findings":[],"high_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":44,"line_start":42}],"confidence":0.88,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced example suggests running git-escrows new-client with a private key argument. Passing a crypto private key through CLI arguments can expose it through shell history or process metadata."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":71,"line_start":60}],"confidence":0.86,"description":"2. Clone it to a temporary location: `git clone <url> /tmp/escrow-tests-<uid> && cd /tmp/escrow-test","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The command clones an escrow-provided repository URL and checks out a supplied commit using a shell command chain. This creates risk from untrusted repositories and unsafely substituted placeholders."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":78,"line_start":77}],"confidence":0.86,"description":"1. Stage and commit the solution: `git add -A && git commit -m \"solution for escrow <uid>\"`","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill instructs git add -A and git commit in the current workspace. Broad staging can include unrelated or sensitive files before submission."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":89,"line_start":84}],"confidence":0.9,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced command submits an escrow fulfillment with dynamic escrow, repo, and commit parameters. It can trigger a networked blockchain-related action through the configured CLI."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":108,"line_start":103}],"confidence":0.9,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced command submits an existing solution to the escrow using dynamic parameters. This is a real external CLI action with network and transaction implications."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":118,"line_start":116}],"confidence":0.88,"description":"```","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced collect command can initiate a follow-up escrow collection action. In a PRIVATE_KEY-backed workflow, this may sign or submit a blockchain transaction."},{"title":"Generic API/secret keys","locations":[{"file":"SKILL.md","line_end":4,"line_start":4}],"confidence":0.94,"description":"compatibility: Requires git-escrows CLI, git, a configured .env with PRIVATE_KEY, and network access","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The compatibility metadata explicitly requires a .env file containing PRIVATE_KEY. A crypto private key is highly sensitive and can authorize transactions."},{"title":"Generic API/secret keys","locations":[{"file":"SKILL.md","line_end":16,"line_start":16}],"confidence":0.95,"description":"primaryEnv: PRIVATE_KEY","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The metadata declares PRIVATE_KEY as the primary environment variable. This confirms the workflow depends on a secret that must be protected."},{"title":"Environment file access","locations":[{"file":"SKILL.md","line_end":4,"line_start":4}],"confidence":0.94,"description":"compatibility: Requires git-escrows CLI, git, a configured .env with PRIVATE_KEY, and network access","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The skill states that a configured .env with PRIVATE_KEY is required. This is sensitive environment-file dependency tied to a crypto key."},{"title":"Environment file access","locations":[{"file":"SKILL.md","line_end":15,"line_start":15}],"confidence":0.86,"description":"- .env","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The metadata lists .env as required configuration. That file is expected to hold PRIVATE_KEY based on nearby metadata, so it is sensitive."},{"title":"Environment file access","locations":[{"file":"SKILL.md","line_end":39,"line_start":39}],"confidence":0.82,"description":"## Step 2: Check .env configuration","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The section begins an explicit .env configuration check. The nearby steps make clear that this environment file relates to private-key setup."},{"title":"Environment file access","locations":[{"file":"SKILL.md","line_end":41,"line_start":41}],"confidence":0.9,"description":"Check if a `.env` file exists in the current directory. If not, tell the user they need one and sugg","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The skill tells the agent to check whether a .env file exists in the current directory. Accessing or validating secret configuration files is sensitive in this workflow."},{"title":"Crypto seed/private key mention","locations":[{"file":"SKILL.md","line_end":43,"line_start":43}],"confidence":0.96,"description":"git-escrows new-client --privateKey \"0x...\" --network \"sepolia\"","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The example command includes a privateKey argument. Even as a placeholder, it encourages command-line handling of a crypto private key, which can leak through local process or shell records."},{"title":"Blockchain Transaction Without Explicit Confirmation","locations":[{"file":"SKILL.md","line_end":89,"line_start":82},{"file":"SKILL.md","line_end":108,"line_start":101},{"file":"SKILL.md","line_end":118,"line_start":115}],"confidence":0.91,"description":"The workflow instructs the agent to run fulfill and collect commands. These actions may sign or submit escrow actions through a PRIVATE_KEY-backed CLI without final user approval.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The skill directly provides fulfill and collect command flows and separately declares PRIVATE_KEY as required. No line requires explicit user confirmation before those transaction-like actions."},{"title":"Broad Git Staging May Publish Unrelated Files","locations":[{"file":"SKILL.md","line_end":80,"line_start":69}],"confidence":0.88,"description":"The workflow tells the agent to work in the current directory and stage all changes before committing. This can include unrelated files or secrets in the submitted solution repository.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The instructions explicitly combine current-directory edits with git add -A and then use the repo URL for fulfillment. This creates a clear accidental disclosure path."}],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":37,"line_start":37}],"confidence":0.82,"description":"Run `git-escrows --help` to verify the CLI is installed. If it fails, try `npx git-escrows --help` o","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill tells the agent to run git-escrows, npx, or bunx commands. This is legitimate setup checking, but it executes external tooling and may fetch packages."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":52,"line_start":48}],"confidence":0.82,"description":"Run `git-escrows list --verbose --format json` and find the escrow matching the provided UID. Confir","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill instructs the agent to run git-escrows list with verbose JSON output. This is expected behavior, but it invokes a networked external CLI."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":60,"line_start":52}],"confidence":0.8,"description":"If no escrow UID was provided, ask the user for one. You can help them browse with `git-escrows list","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill suggests browsing open escrows with git-escrows list. This is a real external command and may contact the configured escrow network."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":121,"line_start":119}],"confidence":0.8,"description":"- Suggest checking status with: `git-escrows list --verbose`","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill suggests running git-escrows list --verbose to check status. This is an external CLI call that may use network and configured credentials."},{"title":"Temp directory access","locations":[{"file":"SKILL.md","line_end":60,"line_start":60}],"confidence":0.78,"description":"2. Clone it to a temporary location: `git clone <url> /tmp/escrow-tests-<uid> && cd /tmp/escrow-test","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"The skill instructs cloning into a predictable /tmp path derived from the escrow UID. This can collide with existing paths and exposes work to normal temporary-directory risks."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":122,"audit_model":"codex","audited_at":"2026-07-10T00:06:19.492+00:00","created_at":"2026-07-10T07:43:48.302764+00:00","static_findings":[{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Mode A (Write + Submit)**: You write the solution code, commit it, and submit. This is the defau","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If they provide `--solution-repo`, use **Mode B**.","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Run `git-escrows --help` to verify the CLI is installed. If it fails, try `npx git-escrows --help` o","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Check if a `.env` file exists in the current directory. If not, tell the user they need one and sugg","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":44,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":48,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Run `git-escrows list --verbose --format json` and find the escrow matching the provided UID. Confir","category":"external_commands","line_end":52,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If no escrow UID was provided, ask the user for one. You can help them browse with `git-escrows list","category":"external_commands","line_end":60,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Clone it to a temporary location: `git clone <url> /tmp/escrow-tests-<uid> && cd /tmp/escrow-test","category":"external_commands","line_end":71,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Follow the project structure the tests expect (e.g., if tests import from `src/math.ts`, create t","category":"external_commands","line_end":77,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Stage and commit the solution: `git add -A && git commit -m \"solution for escrow <uid>\"`","category":"external_commands","line_end":78,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Get the commit hash: `git rev-parse HEAD`","category":"external_commands","line_end":79,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. Get the remote URL: `git remote get-url origin`","category":"external_commands","line_end":84,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":89,"severity":"medium","line_start":84},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":96,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `--solution-repo`: The git repo URL with the solution","category":"external_commands","line_end":97,"severity":"medium","line_start":96},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `--solution-commit`: The commit hash of the solution","category":"external_commands","line_end":103,"severity":"medium","line_start":97},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":108,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":116,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":118,"severity":"medium","line_start":116},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":119,"severity":"medium","line_start":118},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Suggest checking status with: `git-escrows list --verbose`","category":"external_commands","line_end":121,"severity":"medium","line_start":119},{"id":"network:SKILL.md:17:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: https://github.com/arkhai-io/git-commit-trading","category":"network","line_end":17,"severity":"low","line_start":17},{"id":"filesystem:SKILL.md:60:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"2. Clone it to a temporary location: `git clone <url> /tmp/escrow-tests-<uid> && cd /tmp/escrow-test","category":"filesystem","line_end":60,"severity":"medium","line_start":60},{"id":"env_access:SKILL.md:4:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"compatibility: Requires git-escrows CLI, git, a configured .env with PRIVATE_KEY, and network access","category":"env_access","line_end":4,"severity":"high","line_start":4},{"id":"env_access:SKILL.md:16:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"primaryEnv: PRIVATE_KEY","category":"env_access","line_end":16,"severity":"high","line_start":16},{"id":"obfuscation:SKILL.md:18:unicode-escape-sequence","file":"SKILL.md","pattern":"Unicode escape sequence","snippet":"emoji: \"\\U0001F3AF\"","category":"obfuscation","line_end":18,"severity":"low","line_start":18},{"id":"sensitive:SKILL.md:4:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"compatibility: Requires git-escrows CLI, git, a configured .env with PRIVATE_KEY, and network access","category":"sensitive","line_end":4,"severity":"high","line_start":4},{"id":"sensitive:SKILL.md:15:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"- .env","category":"sensitive","line_end":15,"severity":"high","line_start":15},{"id":"sensitive:SKILL.md:39:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"## Step 2: Check .env configuration","category":"sensitive","line_end":39,"severity":"high","line_start":39},{"id":"sensitive:SKILL.md:41:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"Check if a `.env` file exists in the current directory. If not, tell the user they need one and sugg","category":"sensitive","line_end":41,"severity":"high","line_start":41},{"id":"sensitive:SKILL.md:43:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"git-escrows new-client --privateKey \"0x...\" --network \"sepolia\"","category":"sensitive","line_end":43,"severity":"high","line_start":43},{"id":"blocker:SKILL.md:86:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--escrow-uid \"<uid>\" \\","category":"blocker","line_end":86,"severity":"low","line_start":86},{"id":"blocker:SKILL.md:105:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--escrow-uid \"<uid>\" \\","category":"blocker","line_end":105,"severity":"low","line_start":105},{"id":"blocker:SKILL.md:117:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"git-escrows collect --escrow-uid <escrow-uid> --fulfillment-uid <fulfillment-uid>","category":"blocker","line_end":117,"severity":"low","line_start":117}],"finding_verdicts":[{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"This line uses markdown backticks around an option name while explaining workflow modes. It does not instruct command execution on this line.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"This is an inline option name used to choose a mode. There is no shell execution or command construction on this line.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The skill tells the agent to run git-escrows, npx, or bunx commands. This is legitimate setup checking, but it executes external tooling and may fetch packages.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The external-command pattern is triggered by markdown around .env. The security concern is sensitive file handling, covered by separate sensitive findings, not shell execution here.","verdict":"false_positive","confidence":0.86},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The fenced example suggests running git-escrows new-client with a private key argument. Passing a crypto private key through CLI arguments can expose it through shell history or process metadata.","verdict":"confirmed","severity":"high","confidence":0.88},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"This finding lands on a markdown code fence boundary. The actual nearby command is covered by the separate finding starting at line 42.","verdict":"false_positive","confidence":0.88},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"The skill instructs the agent to run git-escrows list with verbose JSON output. This is expected behavior, but it invokes a networked external CLI.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The skill suggests browsing open escrows with git-escrows list. This is a real external command and may contact the configured escrow network.","verdict":"confirmed","severity":"medium","confidence":0.8},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The command clones an escrow-provided repository URL and checks out a supplied commit using a shell command chain. This creates risk from untrusted repositories and unsafely substituted placeholders.","verdict":"confirmed","severity":"high","confidence":0.86},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"This line contains an example source path in markdown backticks. It is not a command and does not execute external tooling.","verdict":"false_positive","confidence":0.91},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The skill instructs git add -A and git commit in the current workspace. Broad staging can include unrelated or sensitive files before submission.","verdict":"confirmed","severity":"high","confidence":0.86},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"git rev-parse HEAD is a read-only git query with hardcoded arguments. It does not create a meaningful command injection or system modification risk by itself.","verdict":"false_positive","confidence":0.82},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"git remote get-url origin is a read-only query for repository metadata. This is normal git workflow context, not dangerous execution by itself.","verdict":"false_positive","confidence":0.81},{"id":"external_commands:SKILL.md:84:ruby-shell-backtick-execution","reason":"The fenced command submits an escrow fulfillment with dynamic escrow, repo, and commit parameters. It can trigger a networked blockchain-related action through the configured CLI.","verdict":"confirmed","severity":"high","confidence":0.9},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"This finding lands on a markdown fence boundary after the fulfill command. The executable fulfill example is covered by the finding at line 84.","verdict":"false_positive","confidence":0.88},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","reason":"This line documents the solution-repo option name. It is an inline argument label, not a command execution site.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","reason":"This line documents the solution-commit option name. It is not an instruction to execute a shell command.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"The fenced command submits an existing solution to the escrow using dynamic parameters. This is a real external CLI action with network and transaction implications.","verdict":"confirmed","severity":"high","confidence":0.9},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"This finding lands on a markdown fence boundary after the Mode B fulfill command. The actual executable example is covered by the finding at line 103.","verdict":"false_positive","confidence":0.88},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"The fenced collect command can initiate a follow-up escrow collection action. In a PRIVATE_KEY-backed workflow, this may sign or submit a blockchain transaction.","verdict":"confirmed","severity":"high","confidence":0.88},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","reason":"This finding lands on a markdown fence boundary after the collect command. The actual command risk is covered by the finding at line 116.","verdict":"false_positive","confidence":0.88},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","reason":"The skill suggests running git-escrows list --verbose to check status. This is an external CLI call that may use network and configured credentials.","verdict":"confirmed","severity":"medium","confidence":0.8},{"id":"network:SKILL.md:17:hardcoded-url","reason":"The hardcoded URL is metadata pointing to the project homepage on GitHub. It is not used for data exfiltration or runtime network access by the skill.","verdict":"false_positive","confidence":0.93},{"id":"filesystem:SKILL.md:60:temp-directory-access","reason":"The skill instructs cloning into a predictable /tmp path derived from the escrow UID. This can collide with existing paths and exposes work to normal temporary-directory risks.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"env_access:SKILL.md:4:generic-api-secret-keys","reason":"The compatibility metadata explicitly requires a .env file containing PRIVATE_KEY. A crypto private key is highly sensitive and can authorize transactions.","verdict":"confirmed","severity":"high","confidence":0.94},{"id":"env_access:SKILL.md:16:generic-api-secret-keys","reason":"The metadata declares PRIVATE_KEY as the primary environment variable. This confirms the workflow depends on a secret that must be protected.","verdict":"confirmed","severity":"high","confidence":0.95},{"id":"obfuscation:SKILL.md:18:unicode-escape-sequence","reason":"The unicode escape is an emoji metadata value. There is no concealed executable content or obfuscated instruction in this line.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:SKILL.md:4:environment-file-access","reason":"The skill states that a configured .env with PRIVATE_KEY is required. This is sensitive environment-file dependency tied to a crypto key.","verdict":"confirmed","severity":"high","confidence":0.94},{"id":"sensitive:SKILL.md:15:environment-file-access","reason":"The metadata lists .env as required configuration. That file is expected to hold PRIVATE_KEY based on nearby metadata, so it is sensitive.","verdict":"confirmed","severity":"high","confidence":0.86},{"id":"sensitive:SKILL.md:39:environment-file-access","reason":"The section begins an explicit .env configuration check. The nearby steps make clear that this environment file relates to private-key setup.","verdict":"confirmed","severity":"high","confidence":0.82},{"id":"sensitive:SKILL.md:41:environment-file-access","reason":"The skill tells the agent to check whether a .env file exists in the current directory. Accessing or validating secret configuration files is sensitive in this workflow.","verdict":"confirmed","severity":"high","confidence":0.9},{"id":"sensitive:SKILL.md:43:crypto-seed-private-key-mention","reason":"The example command includes a privateKey argument. Even as a placeholder, it encourages command-line handling of a crypto private key, which can leak through local process or shell records.","verdict":"confirmed","severity":"high","confidence":0.96},{"id":"blocker:SKILL.md:86:system-reconnaissance","reason":"The line is an escrow UID argument inside a fulfill command. It does not gather system information or perform reconnaissance.","verdict":"false_positive","confidence":0.91},{"id":"blocker:SKILL.md:105:system-reconnaissance","reason":"The line is an escrow UID argument inside another fulfill example. It is not system reconnaissance.","verdict":"false_positive","confidence":0.91},{"id":"blocker:SKILL.md:117:system-reconnaissance","reason":"The collect command uses escrow and fulfillment identifiers, not host or system reconnaissance. Transaction risk is covered by external command findings.","verdict":"false_positive","confidence":0.89}],"semantic_findings":[{"title":"Blockchain Transaction Without Explicit Confirmation","severity":"high","locations":[{"file":"SKILL.md","line_end":89,"line_start":82},{"file":"SKILL.md","line_end":108,"line_start":101},{"file":"SKILL.md","line_end":118,"line_start":115}],"confidence":0.91,"description":"The workflow instructs the agent to run fulfill and collect commands. These actions may sign or submit escrow actions through a PRIVATE_KEY-backed CLI without final user approval.","confidence_reasoning":"The skill directly provides fulfill and collect command flows and separately declares PRIVATE_KEY as required. No line requires explicit user confirmation before those transaction-like actions."},{"title":"Broad Git Staging May Publish Unrelated Files","severity":"high","locations":[{"file":"SKILL.md","line_end":80,"line_start":69}],"confidence":0.88,"description":"The workflow tells the agent to work in the current directory and stage all changes before committing. This can include unrelated files or secrets in the submitted solution repository.","confidence_reasoning":"The instructions explicitly combine current-directory edits with git add -A and then use the repo URL for fulfillment. This creates a clear accidental disclosure path."}],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":7,"capabilityReviewCount":13,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}