{"data":{"skill":{"slug":"internet-court-nla-create","name":"nla-create","icon":"📦","repo":"https://github.com/internet-court/internet-court-skill/tree/main/vendored/arkhai/nla-create","status":"approved","author":"internet-court","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"46de7101-6737-4f67-a52d-a7a26f51b269","skill_id":"8b891e1e-8976-4401-901f-06c37093ef3a","version":1,"content_hash":"8e8fdd0534aa0922fcad45546b42313e","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"The audit found many Markdown backtick false positives, but several findings are real because the skill runs the nla CLI and handles wallet private keys. The highest risks are private key exposure and on-chain escrow creation that can lock ERC20 tokens. No prompt injection or malicious exfiltration intent was found in SKILL.md.","remediation":[{"issue":"Private key handling through CLI arguments or environment variables","severity":"high","suggestion":"Prefer a wallet connector, hardware wallet, or encrypted local wallet flow. Do not ask users to paste private keys into chat, shell history, or process arguments."},{"issue":"Fund-locking on-chain escrow command can run without an explicit final review","severity":"high","suggestion":"Add a mandatory confirmation step that repeats network, token, amount, oracle address, provider, model, and estimated fees before executing nla escrow:create."},{"issue":"User-controlled demand and prompt text are passed to a shell command","severity":"medium","suggestion":"Escape shell arguments carefully or use a safer argument-passing mechanism. Reject values that contain unexpected control characters or unbalanced quotes."},{"issue":"Local development command starts services and deploys contracts","severity":"medium","suggestion":"Warn users before running nla dev and explain that it starts Anvil, deploys contracts, creates tokens, and starts an oracle."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":34,"line_start":34},{"file":"SKILL.md","line_end":47,"line_start":38},{"file":"SKILL.md","line_end":50,"line_start":47},{"file":"SKILL.md","line_end":51,"line_start":50},{"file":"SKILL.md","line_end":52,"line_start":51},{"file":"SKILL.md","line_end":64,"line_start":52},{"file":"SKILL.md","line_end":73,"line_start":64},{"file":"SKILL.md","line_end":77,"line_start":73},{"file":"SKILL.md","line_end":81,"line_start":77},{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":83,"line_start":82},{"file":"SKILL.md","line_end":85,"line_start":83},{"file":"SKILL.md","line_end":91,"line_start":85},{"file":"SKILL.md","line_end":95,"line_start":91},{"file":"SKILL.md","line_end":103,"line_start":95}]},{"factor":"env_access","evidence":[{"file":"SKILL.md","line_end":52,"line_start":52}]}],"critical_findings":[],"high_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":51,"line_start":50}],"confidence":0.9,"description":"- Run `nla wallet:set --private-key <key>`","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill suggests running a wallet setup command with a private key. That is external command execution involving a high-value wallet secret."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":52,"line_start":51}],"confidence":0.91,"description":"- Pass `--private-key <key>` to the command","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill allows passing a private key directly as a CLI argument. Command-line arguments can be exposed through shell history or process listings."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":64,"line_start":52}],"confidence":0.89,"description":"- Set the `PRIVATE_KEY` environment variable","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The skill suggests configuring a PRIVATE_KEY environment variable for command execution. Environment variables can leak to subprocesses or logs if handled carelessly."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":73,"line_start":64}],"confidence":0.9,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced block runs nla escrow:create with user-supplied demand, amount, token, oracle, and prompt values. This creates an on-chain escrow and can lock funds."},{"title":"Generic API/secret keys","locations":[{"file":"SKILL.md","line_end":52,"line_start":52}],"confidence":0.93,"description":"- Set the `PRIVATE_KEY` environment variable","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"The line explicitly tells users to set a PRIVATE_KEY environment variable. That is sensitive wallet material and can be exposed if inherited by tools or logged."},{"title":"On-chain escrow action lacks an explicit final confirmation step","locations":[{"file":"SKILL.md","line_end":72,"line_start":64}],"confidence":0.78,"description":"The skill guides execution of nla escrow:create with amount, token, oracle, and arbitration parameters. It should require a final user confirmation before any fund-locking transaction.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The command block directly creates an escrow with financial parameters. The file does not show an explicit final confirmation requirement before execution."}],"medium_findings":[{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":47,"line_start":38}],"confidence":0.82,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The fenced block contains Bash commands that query the local nla installation, network, and wallet. These are expected checks but still execute external local commands."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":81,"line_start":81}],"confidence":0.8,"description":"- Available networks: `anvil` (local), `sepolia`, `base-sepolia`, `mainnet`. Switch with `nla switch","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The line instructs users to switch networks with an nla command. It is legitimate CLI guidance but still changes the execution target for later blockchain actions."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":83,"line_start":82}],"confidence":0.82,"description":"- For local dev, `nla dev` starts Anvil, deploys contracts, creates mock tokens, and starts the orac","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The line documents nla dev, which starts local services and deploys development contracts. This is expected tooling but it executes external commands with local side effects."},{"title":"Ruby/shell backtick execution","locations":[{"file":"SKILL.md","line_end":103,"line_start":95}],"confidence":0.78,"description":"```bash","review_kind":"capability","source_category":"external_commands","source_severity":"medium","confidence_reasoning":"The example block contains an nla escrow:create command that could be copied and executed. It is illustrative but still demonstrates external command execution for an on-chain action."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":104,"audit_model":"codex","audited_at":"2026-07-10T00:20:13.582+00:00","created_at":"2026-07-10T07:43:53.313282+00:00","static_findings":[{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Help the user create a blockchain escrow backed by a natural language demand using the `nla` CLI.","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Token address**: ERC20 token contract address (`0x...`).","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Arbitration provider**: `OpenAI` (default), `Anthropic`, or `OpenRouter`.","category":"external_commands","line_end":32,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Arbitration model**: e.g. `gpt-4o-mini` (default), `claude-3-5-sonnet-20241022`, `openai/gpt-4o`","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Arbitration prompt**: Custom prompt template with `{{demand}}` and `{{obligation}}` placeholders","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":47,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":50,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Run `nla wallet:set --private-key <key>`","category":"external_commands","line_end":51,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Pass `--private-key <key>` to the command","category":"external_commands","line_end":52,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Set the `PRIVATE_KEY` environment variable","category":"external_commands","line_end":64,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":73,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":77,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The command outputs an escrow UID (`0x...`). This UID is needed for fulfillment and collection. Pres","category":"external_commands","line_end":81,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Available networks: `anvil` (local), `sepolia`, `base-sepolia`, `mainnet`. Switch with `nla switch","category":"external_commands","line_end":81,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- For local dev, `nla dev` starts Anvil, deploys contracts, creates mock tokens, and starts the orac","category":"external_commands","line_end":83,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Public demo oracle on Sepolia: `0xc5c132B69f57dAAAb75d9ebA86cab504b272Ccbc`.","category":"external_commands","line_end":85,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":91,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":95,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":103,"severity":"medium","line_start":95},{"id":"env_access:SKILL.md:52:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"- Set the `PRIVATE_KEY` environment variable","category":"env_access","line_end":52,"severity":"high","line_start":52},{"id":"blocker:SKILL.md:58:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Consider: what counts as valid fulfillment? Is the condition verifiable?","category":"blocker","line_end":58,"severity":"low","line_start":58},{"id":"blocker:SKILL.md:97:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"--demand \"Provide a valid proof that P != NP\" \\","category":"blocker","line_end":97,"severity":"low","line_start":97}],"finding_verdicts":[{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"This line uses Markdown inline formatting for the nla CLI name. It does not invoke a shell or describe executable Ruby backtick behavior.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"The backticked text is only an ERC20 address format example. It is not a command, shell expression, or executable instruction.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"The line lists arbitration provider names in Markdown code spans. No command execution is requested or implied by this line.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The backticks format model names as literals for documentation. They are not shell backticks or executable code.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The line documents prompt placeholders inside Markdown code spans. This is template text, not shell execution.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The fenced block contains Bash commands that query the local nla installation, network, and wallet. These are expected checks but still execute external local commands.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"The finding starts on a Markdown code-fence closing line. The nearby wallet command is covered by a separate static finding at line 50.","verdict":"false_positive","confidence":0.86},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The skill suggests running a wallet setup command with a private key. That is external command execution involving a high-value wallet secret.","verdict":"confirmed","severity":"high","confidence":0.9},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"The skill allows passing a private key directly as a CLI argument. Command-line arguments can be exposed through shell history or process listings.","verdict":"confirmed","severity":"high","confidence":0.91},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The skill suggests configuring a PRIVATE_KEY environment variable for command execution. Environment variables can leak to subprocesses or logs if handled carelessly.","verdict":"confirmed","severity":"high","confidence":0.89},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The fenced block runs nla escrow:create with user-supplied demand, amount, token, oracle, and prompt values. This creates an on-chain escrow and can lock funds.","verdict":"confirmed","severity":"high","confidence":0.9},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"The finding points to the closing fence after the escrow command example. It does not itself add a new executable instruction beyond the command finding at line 64.","verdict":"false_positive","confidence":0.89},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The line explains that the command outputs an escrow UID and formats an address pattern. It does not request command execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"The line instructs users to switch networks with an nla command. It is legitimate CLI guidance but still changes the execution target for later blockchain actions.","verdict":"confirmed","severity":"medium","confidence":0.8},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"The line documents nla dev, which starts local services and deploys development contracts. This is expected tooling but it executes external commands with local side effects.","verdict":"confirmed","severity":"medium","confidence":0.82},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The backticked text is a public Sepolia oracle address. It is not a shell command or dynamic execution construct.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"The fenced block contains a plain arbitration prompt template, not Bash or executable code. It is documentation for oracle evaluation text.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"This line is the closing fence for the arbitration prompt template. It does not contain or trigger command execution.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"The example block contains an nla escrow:create command that could be copied and executed. It is illustrative but still demonstrates external command execution for an on-chain action.","verdict":"confirmed","severity":"medium","confidence":0.78},{"id":"env_access:SKILL.md:52:generic-api-secret-keys","reason":"The line explicitly tells users to set a PRIVATE_KEY environment variable. That is sensitive wallet material and can be exposed if inherited by tools or logged.","verdict":"confirmed","severity":"high","confidence":0.93},{"id":"blocker:SKILL.md:58:system-reconnaissance","reason":"The line asks whether an escrow condition is verifiable by an LLM. It does not instruct host, network, or system reconnaissance.","verdict":"false_positive","confidence":0.96},{"id":"blocker:SKILL.md:97:system-reconnaissance","reason":"The demand asks for a mathematical proof and is used as an escrow example. It is not a request to enumerate or probe a system.","verdict":"false_positive","confidence":0.94}],"semantic_findings":[{"title":"On-chain escrow action lacks an explicit final confirmation step","severity":"high","locations":[{"file":"SKILL.md","line_end":72,"line_start":64}],"confidence":0.78,"description":"The skill guides execution of nla escrow:create with amount, token, oracle, and arbitration parameters. It should require a final user confirmation before any fund-locking transaction.","confidence_reasoning":"The command block directly creates an escrow with financial parameters. The file does not show an explicit final confirmation requirement before execution."}],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":1,"capabilityReviewCount":9,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}