{"data":{"skill":{"slug":"internet-court-genlayer-cli","name":"genlayer-cli","icon":"📦","repo":"https://github.com/internet-court/internet-court-skill/tree/main/vendored/genlayer/genlayer-cli","status":"approved","author":"internet-court","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"21563069-5dfd-446d-8e39-97eb500b59b8","skill_id":"553c1c9a-31cb-4622-9f98-607b7cbf590f","version":1,"content_hash":"f3fe9d79abaabc96d11dfffca1971326","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"Most static external-command findings are Markdown documentation false positives, but several documented CLI actions are real state-changing or secret-handling risks. The highest concern is guidance around private keys and passwords in command-line workflows.","remediation":[{"issue":"Password and private-key examples encourage command-line secret handling.","severity":"high","suggestion":"Recommend keychain, keystore prompts, or secret managers. Warn users not to place real private keys or passwords in prompts, shell history, or process arguments."},{"issue":"State-changing commands can deploy contracts, send funds, appeal transactions, reset local databases, or modify validators.","severity":"medium","suggestion":"Add explicit confirmation guidance before deploy, write, send, appeal, reset, validator delete, and configuration changes."},{"issue":"Global package installation changes the user environment and runs third-party package code.","severity":"medium","suggestion":"Suggest verifying the package source and version before installation, and prefer project-local or sandboxed installation when possible."},{"issue":"The faucet URL is hardcoded in documentation.","severity":"low","suggestion":"Tell users to verify the official GenLayer domain before using faucet pages or entering addresses."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":17,"line_start":15},{"file":"SKILL.md","line_end":21,"line_start":17},{"file":"SKILL.md","line_end":26,"line_start":21},{"file":"SKILL.md","line_end":28,"line_start":26},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":32,"line_start":30},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":52,"line_start":38},{"file":"SKILL.md","line_end":54,"line_start":52},{"file":"SKILL.md","line_end":54,"line_start":54},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":63,"line_start":60},{"file":"SKILL.md","line_end":65,"line_start":63},{"file":"SKILL.md","line_end":65,"line_start":65},{"file":"SKILL.md","line_end":69,"line_start":67},{"file":"SKILL.md","line_end":81,"line_start":69},{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":89,"line_start":83},{"file":"SKILL.md","line_end":96,"line_start":89},{"file":"SKILL.md","line_end":101,"line_start":96},{"file":"SKILL.md","line_end":104,"line_start":101},{"file":"SKILL.md","line_end":107,"line_start":104},{"file":"SKILL.md","line_end":110,"line_start":107},{"file":"SKILL.md","line_end":113,"line_start":110},{"file":"SKILL.md","line_end":116,"line_start":113},{"file":"SKILL.md","line_end":122,"line_start":116},{"file":"SKILL.md","line_end":137,"line_start":122},{"file":"SKILL.md","line_end":139,"line_start":137},{"file":"SKILL.md","line_end":139,"line_start":139},{"file":"SKILL.md","line_end":143,"line_start":143},{"file":"SKILL.md","line_end":147,"line_start":146},{"file":"SKILL.md","line_end":148,"line_start":147},{"file":"SKILL.md","line_end":149,"line_start":148},{"file":"SKILL.md","line_end":149,"line_start":149},{"file":"SKILL.md","line_end":162,"line_start":154},{"file":"SKILL.md","line_end":162,"line_start":162},{"file":"SKILL.md","line_end":163,"line_start":163},{"file":"SKILL.md","line_end":170,"line_start":164},{"file":"SKILL.md","line_end":172,"line_start":170},{"file":"SKILL.md","line_end":176,"line_start":172},{"file":"SKILL.md","line_end":182,"line_start":176},{"file":"SKILL.md","line_end":186,"line_start":182},{"file":"SKILL.md","line_end":193,"line_start":186},{"file":"SKILL.md","line_end":199,"line_start":193},{"file":"SKILL.md","line_end":200,"line_start":199},{"file":"SKILL.md","line_end":200,"line_start":200},{"file":"SKILL.md","line_end":202,"line_start":201},{"file":"SKILL.md","line_end":203,"line_start":202}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":79,"line_start":79}]}],"critical_findings":[],"high_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":52,"line_start":38}],"confidence":0.86,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This account-management block includes commands for account creation, private-key import, unlocking, and token transfer. These commands can expose key material or move funds if run without careful confirmation."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":58,"line_start":58}],"confidence":0.82,"description":"`account create`, `account import`, and `account send` accept `--password <password>` to skip intera","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The text recommends non-interactive password arguments for account commands. Passwords in command arguments can appear in shell history, process listings, and logs."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":63,"line_start":60}],"confidence":0.9,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This command block shows placeholder passwords and a private-key import in command-line arguments. The pattern can train users or agents to place secrets in shell history and observable process arguments."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":69,"line_start":67}],"confidence":0.88,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This command block pipes a password into a deployment command. Echoing secrets can leak through shell history, logs, or terminal capture even when the example uses a placeholder."},{"title":"Crypto seed/private key mention","locations":[{"file":"SKILL.md","line_end":46,"line_start":46}],"confidence":0.9,"description":"# Import from private key or keystore","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"The account import section explicitly introduces private-key and keystore import flows. Handling these secrets in an AI-assisted shell workflow creates a real risk of key disclosure."},{"title":"Insecure Secret Handling Guidance","locations":[{"file":"SKILL.md","line_end":68,"line_start":58}],"confidence":0.92,"description":"The skill recommends command-line password arguments and echoing a password into a signing command. These patterns can expose secrets through shell history, process listings, logs, or copied prompts.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The guidance directly shows non-interactive password handling for account import and deployment flows. The risk is clear even though the examples use placeholder values."}],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":17,"line_start":15}],"confidence":0.78,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This block instructs users to run a global npm installation for the GenLayer CLI. Installing global packages executes third-party package code and changes the host environment."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":26,"line_start":21}],"confidence":0.7,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This block instructs users to run GenLayer network configuration commands. Changing the active network can redirect later deployments or transactions to a different chain."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":96,"line_start":89}],"confidence":0.76,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This block instructs users to deploy GenLayer contracts. Deployment is a state-changing external command that can spend funds or publish contract code to the selected network."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":110,"line_start":107}],"confidence":0.76,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This block instructs users to send write transactions to contracts. Write calls are state-changing external commands and can affect on-chain or local network state."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":172,"line_start":170}],"confidence":0.72,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This block instructs users to appeal a transaction result. Appeals are external state-changing actions that can trigger validator re-evaluation."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":182,"line_start":176}],"confidence":0.74,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This block includes local Studio management commands, including a database reset option. These commands can start services or delete local development state."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":193,"line_start":186}],"confidence":0.72,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This block includes local validator creation, update, and deletion commands. These commands can materially change local consensus test configuration."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":208,"line_start":204}],"confidence":0.72,"description":"6. **Appeal if needed**: `genlayer appeal <txHash>` (re-run consensus)","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The debugging workflow includes an appeal command as a possible next action. That command can change transaction handling by triggering validator re-evaluation."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":211,"line_start":208}],"confidence":0.67,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This block instructs users to create a new GenLayer project from a template. It writes files to the local filesystem and should be confirmed before execution."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":220,"line_start":215}],"confidence":0.68,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"This block includes configuration set and reset commands. Changing CLI configuration can affect later deployments, calls, and transaction submissions."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":227,"audit_model":"codex","audited_at":"2026-07-09T23:41:44.254+00:00","created_at":"2026-07-10T07:43:48.50099+00:00","static_findings":[{"id":"external_commands:SKILL.md:11:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The `genlayer` CLI manages contract deployment, interaction, transaction inspection, and network con","category":"external_commands","line_end":11,"severity":"medium","line_start":11},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":17,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":21,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":26,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":28,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Networks: `localnet`, `studionet`, `testnet-asimov`, `testnet-bradbury`","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Note**: `studionet` is gasless — no tokens are required to deploy or interact with contracts. A 0 ","category":"external_commands","line_end":32,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Note**: `studionet` is rate-limited per IP — **60 req/min, 1000 req/hr, 10000 req/day**. Limits ar","category":"external_commands","line_end":32,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Always use `genlayer network set` instead of `--rpc`** for built-in networks. The `--rpc` flag byp","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":52,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":54,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Amount formats: `\"10gen\"`, `\"0.5gen\"`, or raw wei `\"1000000000000000000\"`","category":"external_commands","line_end":54,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`account create`, `account import`, and `account send` accept `--password <password>` to skip intera","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":63,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":65,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`account unlock` requires an OS keychain (macOS Keychain, GNOME Keyring, etc.) and will fail in head","category":"external_commands","line_end":65,"severity":"medium","line_start":65},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":69,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":81,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Get your address: `genlayer account` -> copy the `address` field","category":"external_commands","line_end":81,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. Verify: `genlayer account` should show the updated balance","category":"external_commands","line_end":89,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":96,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":101,"severity":"medium","line_start":96},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":104,"severity":"medium","line_start":101},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":107,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":110,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":113,"severity":"medium","line_start":110},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":116,"severity":"medium","line_start":113},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":122,"severity":"medium","line_start":116},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":137,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":139,"severity":"medium","line_start":137},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Transaction lifecycle statuses: `SUBMITTED` -> `PENDING` -> `ACCEPTED` -> `FINALIZED`","category":"external_commands","line_end":139,"severity":"medium","line_start":139},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`ACCEPTED` and `FINALIZED` mean the network accepted or finalized the transaction","category":"external_commands","line_end":143,"severity":"medium","line_start":143},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If contract execution fails, the transaction can still become `ACCEPTED` and","category":"external_commands","line_end":147,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"later `FINALIZED`, but state changes are not applied. For deploy transactions,","category":"external_commands","line_end":148,"severity":"medium","line_start":147},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"that means no contract is created. In that case, `genlayer code`,","category":"external_commands","line_end":149,"severity":"medium","line_start":148},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`genlayer schema`, `eth_getCode`, or `gen_getContractSchema` returning no","category":"external_commands","line_end":149,"severity":"medium","line_start":149},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Run `genlayer receipt <txHash> --stdout --stderr`.","category":"external_commands","line_end":162,"severity":"medium","line_start":154},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `ACCEPTED`/`FINALIZED` + execution error + no code/schema | Expected failed deploy; fix the contra","category":"external_commands","line_end":162,"severity":"medium","line_start":162},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `ACCEPTED`/`FINALIZED` + execution success + no code/schema | Possible RPC, indexer, or state-read","category":"external_commands","line_end":163,"severity":"medium","line_start":163},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `PENDING`, missing receipt, or transaction not found | Polling, network, or transaction propagatio","category":"external_commands","line_end":170,"severity":"medium","line_start":164},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":172,"severity":"medium","line_start":170},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":176,"severity":"medium","line_start":172},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":182,"severity":"medium","line_start":176},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":186,"severity":"medium","line_start":182},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":193,"severity":"medium","line_start":186},{"id":"external_commands:SKILL.md:193:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":199,"severity":"medium","line_start":193},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Get the receipt**: `genlayer receipt <txHash> --stdout --stderr`","category":"external_commands","line_end":200,"severity":"medium","line_start":199},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Check execution result**: lifecycle status alone is not enough; `ACCEPTED`/`FINALIZED` can cont","category":"external_commands","line_end":200,"severity":"medium","line_start":200},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **Check contract schema**: `genlayer schema <address>` (verify method exists, correct args)","category":"external_commands","line_end":202,"severity":"medium","line_start":201},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. **Read contract source**: `genlayer code <address>` (verify deployed code matches local)","category":"external_commands","line_end":203,"severity":"medium","line_start":202},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. **Try a read call**: `genlayer call <address> <view_method>` (check current state)","category":"external_commands","line_end":204,"severity":"medium","line_start":203},{"id":"external_commands:SKILL.md:204:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"6. **Appeal if needed**: `genlayer appeal <txHash>` (re-run consensus)","category":"external_commands","line_end":208,"severity":"medium","line_start":204},{"id":"external_commands:SKILL.md:208:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":211,"severity":"medium","line_start":208},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":215,"severity":"medium","line_start":211},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":220,"severity":"medium","line_start":215},{"id":"network:SKILL.md:79:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"**Faucet**: [https://testnet-faucet.genlayer.foundation/](https://testnet-faucet.genlayer.foundation","category":"network","line_end":79,"severity":"low","line_start":79},{"id":"sensitive:SKILL.md:46:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"# Import from private key or keystore","category":"sensitive","line_end":46,"severity":"high","line_start":46}],"finding_verdicts":[{"id":"external_commands:SKILL.md:11:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"This block instructs users to run a global npm installation for the GenLayer CLI. Installing global packages executes third-party package code and changes the host environment.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"This block instructs users to run GenLayer network configuration commands. Changing the active network can redirect later deployments or transactions to a different chain.","verdict":"confirmed","severity":"medium","confidence":0.7},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"This account-management block includes commands for account creation, private-key import, unlocking, and token transfer. These commands can expose key material or move funds if run without careful confirmation.","verdict":"confirmed","severity":"high","confidence":0.86},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"The text recommends non-interactive password arguments for account commands. Passwords in command arguments can appear in shell history, process listings, and logs.","verdict":"confirmed","severity":"high","confidence":0.82},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"This command block shows placeholder passwords and a private-key import in command-line arguments. The pattern can train users or agents to place secrets in shell history and observable process arguments.","verdict":"confirmed","severity":"high","confidence":0.9},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:65:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"This command block pipes a password into a deployment command. Echoing secrets can leak through shell history, logs, or terminal capture even when the example uses a placeholder.","verdict":"confirmed","severity":"high","confidence":0.88},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"This block instructs users to deploy GenLayer contracts. Deployment is a state-changing external command that can spend funds or publish contract code to the selected network.","verdict":"confirmed","severity":"medium","confidence":0.76},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","reason":"This is a documented read-only GenLayer CLI lookup or debugging step. It is not Ruby backtick execution and does not build a dynamic shell command from user input.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"This block instructs users to send write transactions to contracts. Write calls are state-changing external commands and can affect on-chain or local network state.","verdict":"confirmed","severity":"medium","confidence":0.76},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","reason":"This is a documented read-only GenLayer CLI lookup or debugging step. It is not Ruby backtick execution and does not build a dynamic shell command from user input.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"This is a documented read-only GenLayer CLI lookup or debugging step. It is not Ruby backtick execution and does not build a dynamic shell command from user input.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:143:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:147:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:154:ruby-shell-backtick-execution","reason":"This is a documented read-only GenLayer CLI lookup or debugging step. It is not Ruby backtick execution and does not build a dynamic shell command from user input.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:163:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","reason":"This block instructs users to appeal a transaction result. Appeals are external state-changing actions that can trigger validator re-evaluation.","verdict":"confirmed","severity":"medium","confidence":0.72},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","reason":"This block includes local Studio management commands, including a database reset option. These commands can start services or delete local development state.","verdict":"confirmed","severity":"medium","confidence":0.74},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","reason":"This block includes local validator creation, update, and deletion commands. These commands can materially change local consensus test configuration.","verdict":"confirmed","severity":"medium","confidence":0.72},{"id":"external_commands:SKILL.md:193:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:199:ruby-shell-backtick-execution","reason":"This is a documented read-only GenLayer CLI lookup or debugging step. It is not Ruby backtick execution and does not build a dynamic shell command from user input.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:201:ruby-shell-backtick-execution","reason":"This is a documented read-only GenLayer CLI lookup or debugging step. It is not Ruby backtick execution and does not build a dynamic shell command from user input.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:202:ruby-shell-backtick-execution","reason":"This is a documented read-only GenLayer CLI lookup or debugging step. It is not Ruby backtick execution and does not build a dynamic shell command from user input.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:203:ruby-shell-backtick-execution","reason":"This is a documented read-only GenLayer CLI lookup or debugging step. It is not Ruby backtick execution and does not build a dynamic shell command from user input.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:204:ruby-shell-backtick-execution","reason":"The debugging workflow includes an appeal command as a possible next action. That command can change transaction handling by triggering validator re-evaluation.","verdict":"confirmed","severity":"medium","confidence":0.72},{"id":"external_commands:SKILL.md:208:ruby-shell-backtick-execution","reason":"This block instructs users to create a new GenLayer project from a template. It writes files to the local filesystem and should be confirmed before execution.","verdict":"confirmed","severity":"medium","confidence":0.67},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","reason":"This finding is caused by Markdown backticks, code fences, command names, or status labels in documentation. It is not Ruby backtick execution and does not show dynamic shell evaluation.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","reason":"This block includes configuration set and reset commands. Changing CLI configuration can affect later deployments, calls, and transaction submissions.","verdict":"confirmed","severity":"medium","confidence":0.68},{"id":"network:SKILL.md:79:hardcoded-url","reason":"The URL points to the documented GenLayer testnet faucet and is presented for manual browser use. No evidence shows hidden exfiltration, automated network calls, or credential transmission.","verdict":"false_positive","confidence":0.88},{"id":"sensitive:SKILL.md:46:crypto-seed-private-key-mention","reason":"The account import section explicitly introduces private-key and keystore import flows. Handling these secrets in an AI-assisted shell workflow creates a real risk of key disclosure.","verdict":"confirmed","severity":"high","confidence":0.9}],"semantic_findings":[{"title":"Insecure Secret Handling Guidance","severity":"high","locations":[{"file":"SKILL.md","line_end":68,"line_start":58}],"confidence":0.92,"description":"The skill recommends command-line password arguments and echoing a password into a signing command. These patterns can expose secrets through shell history, process listings, logs, or copied prompts.","confidence_reasoning":"The guidance directly shows non-interactive password handling for account import and deployment flows. The risk is clear even though the examples use placeholder values."}],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":2,"capabilityReviewCount":14,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}