{"data":{"skill":{"slug":"internet-court-openserv-agent-sdk","name":"openserv-agent-sdk","icon":"📦","repo":"https://github.com/internet-court/internet-court-skill/tree/main/vendored/openserv/openserv-agent-sdk","status":"approved","author":"internet-court","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"eb8d6440-fba2-4277-ba25-289858521110","skill_id":"7d45cbcd-53a3-4db8-9bd7-d898d3d7dba0","version":2,"content_hash":"v3:3f6e026a3363e0954ede7bef0cfe88d4475de137:11889e6dcecacff187f6490c6638695bb546e2a3254df44bb11e0a05e29c36e1:71898b48419b93968d81623ce81e91d4e208bb14bb6e32645f8efab5e16615ae:736b696c6c732f696e7465726e65742d636f7572742f6f70656e736572762d6167656e742d73646b:fef700dd94c3d7b53d018fba71477423","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"This is a documentation-only skill teaching how to build agents with the OpenServ TypeScript SDK (@openserv-labs/sdk); it ships Markdown reference docs and .ts example files, not an executable installer. Of 248 static hits, 237 are false positives: the \"shell backtick execution\" flags are JavaScript template literals and Markdown code fences, and the \"API/secret key\" and \".env\" flags are placeholder names in an env.example and configuration prose with no real secrets embedded. 11 findings are kept at low severity for visibility because the documented provision() flow persists a crypto WALLET_PRIVATE_KEY to .env for on-chain (ERC-8004 / x402 / USDC) payments — a transparent, documented behavior a reviewer should be aware of, not exfiltration.","remediation":[{"issue":"The provision() workflow persists a wallet private key (WALLET_PRIVATE_KEY) to the .env file at runtime for on-chain payments.","severity":"low","suggestion":"Document that WALLET_PRIVATE_KEY should be a low-value, dedicated payment wallet, that .env must be gitignored, and consider recommending a secrets manager or KMS over a plaintext .env file for production deployments."},{"issue":"env.example lists commented placeholders for third-party keys (OPENAI_API_KEY, ANTHROPIC_API_KEY).","severity":"safe","suggestion":"Keep these as clearly commented, empty placeholders (as they already are) and add a one-line note that most agents need no LLM key when using runless capabilities or generate()."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"examples/basic-agent.ts","line_end":27,"line_start":27},{"file":"examples/basic-agent.ts","line_end":28,"line_start":28},{"file":"examples/basic-agent.ts","line_end":54,"line_start":54},{"file":"examples/capability-example.ts","line_end":39,"line_start":39},{"file":"examples/capability-example.ts","line_end":45,"line_start":43},{"file":"examples/capability-with-agent-methods.ts","line_end":34,"line_start":34},{"file":"examples/capability-with-agent-methods.ts","line_end":39,"line_start":39},{"file":"examples/capability-with-agent-methods.ts","line_end":46,"line_start":46},{"file":"examples/capability-with-agent-methods.ts","line_end":65,"line_start":65},{"file":"examples/error-handling.ts","line_end":51,"line_start":51},{"file":"examples/file-operations.ts","line_end":22,"line_start":22},{"file":"examples/file-operations.ts","line_end":43,"line_start":43},{"file":"examples/file-operations.ts","line_end":61,"line_start":61},{"file":"examples/haiku-poet-agent.ts","line_end":53,"line_start":53},{"file":"examples/haiku-poet-agent.ts","line_end":54,"line_start":54},{"file":"examples/multiple-capabilities.ts","line_end":41,"line_start":41},{"file":"examples/task-management.ts","line_end":44,"line_start":44},{"file":"examples/task-management.ts","line_end":97,"line_start":97},{"file":"reference.md","line_end":127,"line_start":121},{"file":"reference.md","line_end":134,"line_start":127},{"file":"reference.md","line_end":134,"line_start":134},{"file":"reference.md","line_end":283,"line_start":278},{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":23,"line_start":23},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":36,"line_start":34},{"file":"SKILL.md","line_end":38,"line_start":36},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":46,"line_start":42},{"file":"SKILL.md","line_end":47,"line_start":46},{"file":"SKILL.md","line_end":48,"line_start":47},{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":57,"line_start":49},{"file":"SKILL.md","line_end":64,"line_start":57},{"file":"SKILL.md","line_end":68,"line_start":64},{"file":"SKILL.md","line_end":72,"line_start":68},{"file":"SKILL.md","line_end":74,"line_start":72},{"file":"SKILL.md","line_end":74,"line_start":74},{"file":"SKILL.md","line_end":78,"line_start":78},{"file":"SKILL.md","line_end":97,"line_start":80},{"file":"SKILL.md","line_end":107,"line_start":97},{"file":"SKILL.md","line_end":109,"line_start":107},{"file":"SKILL.md","line_end":135,"line_start":109},{"file":"SKILL.md","line_end":137,"line_start":135}]},{"factor":"network","evidence":[{"file":"examples/basic-agent.ts","line_end":54,"line_start":54},{"file":"reference.md","line_end":265,"line_start":265},{"file":"reference.md","line_end":310,"line_start":310},{"file":"reference.md","line_end":315,"line_start":315},{"file":"reference.md","line_end":317,"line_start":317},{"file":"reference.md","line_end":344,"line_start":344},{"file":"SKILL.md","line_end":358,"line_start":358},{"file":"SKILL.md","line_end":423,"line_start":423}]},{"factor":"env_access","evidence":[{"file":"examples/basic-agent.ts","line_end":9,"line_start":9},{"file":"examples/env.example","line_end":3,"line_start":3},{"file":"examples/env.example","line_end":4,"line_start":4},{"file":"examples/env.example","line_end":7,"line_start":7},{"file":"examples/env.example","line_end":10,"line_start":10},{"file":"examples/env.example","line_end":11,"line_start":11},{"file":"examples/haiku-poet-agent.ts","line_end":9,"line_start":9},{"file":"reference.md","line_end":302,"line_start":302},{"file":"reference.md","line_end":306,"line_start":306},{"file":"reference.md","line_end":302,"line_start":302},{"file":"reference.md","line_end":306,"line_start":306},{"file":"reference.md","line_end":30,"line_start":30},{"file":"reference.md","line_end":289,"line_start":289},{"file":"reference.md","line_end":292,"line_start":292},{"file":"reference.md","line_end":293,"line_start":293},{"file":"reference.md","line_end":298,"line_start":298},{"file":"reference.md","line_end":276,"line_start":276},{"file":"reference.md","line_end":289,"line_start":289},{"file":"reference.md","line_end":297,"line_start":297},{"file":"reference.md","line_end":302,"line_start":302},{"file":"reference.md","line_end":306,"line_start":306},{"file":"reference.md","line_end":331,"line_start":331},{"file":"reference.md","line_end":335,"line_start":335},{"file":"reference.md","line_end":336,"line_start":336},{"file":"reference.md","line_end":338,"line_start":338},{"file":"reference.md","line_end":340,"line_start":340},{"file":"SKILL.md","line_end":301,"line_start":301},{"file":"SKILL.md","line_end":412,"line_start":412},{"file":"SKILL.md","line_end":416,"line_start":416},{"file":"SKILL.md","line_end":301,"line_start":301},{"file":"SKILL.md","line_end":412,"line_start":412},{"file":"SKILL.md","line_end":416,"line_start":416},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":384,"line_start":384},{"file":"SKILL.md","line_end":385,"line_start":385},{"file":"SKILL.md","line_end":388,"line_start":388},{"file":"SKILL.md","line_end":389,"line_start":389},{"file":"SKILL.md","line_end":407,"line_start":407},{"file":"SKILL.md","line_end":78,"line_start":78},{"file":"SKILL.md","line_end":82,"line_start":82},{"file":"SKILL.md","line_end":83,"line_start":83},{"file":"SKILL.md","line_end":86,"line_start":86},{"file":"SKILL.md","line_end":89,"line_start":89},{"file":"SKILL.md","line_end":90,"line_start":90},{"file":"SKILL.md","line_end":294,"line_start":294},{"file":"SKILL.md","line_end":295,"line_start":295},{"file":"SKILL.md","line_end":301,"line_start":301},{"file":"SKILL.md","line_end":337,"line_start":337},{"file":"SKILL.md","line_end":344,"line_start":344},{"file":"SKILL.md","line_end":384,"line_start":384}]},{"factor":"scripts","evidence":[{"file":"troubleshooting.md","line_end":175,"line_start":175},{"file":"troubleshooting.md","line_end":179,"line_start":179},{"file":"troubleshooting.md","line_end":180,"line_start":180},{"file":"troubleshooting.md","line_end":186,"line_start":186}]}],"critical_findings":[],"high_findings":[{"title":"Generic API/secret keys","locations":[{"file":"examples/env.example","line_end":10,"line_start":10}],"confidence":0.4,"description":"WALLET_PRIVATE_KEY=","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility."},{"title":"Generic API/secret keys","locations":[{"file":"reference.md","line_end":276,"line_start":276}],"confidence":0.4,"description":"// Top up credits with USDC (uses WALLET_PRIVATE_KEY env var)","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility."},{"title":"Generic API/secret keys","locations":[{"file":"reference.md","line_end":289,"line_start":289}],"confidence":0.4,"description":"**Important:** `provision()` writes `WALLET_PRIVATE_KEY` to `.env` at runtime. If you use `import 'd","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility."},{"title":"Generic API/secret keys","locations":[{"file":"reference.md","line_end":340,"line_start":340}],"confidence":0.4,"description":"WALLET_PRIVATE_KEY=auto-populated (also used for x402 payments, USDC top-up, and ERC-8004 registrati","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility."},{"title":"Environment file access","locations":[{"file":"reference.md","line_end":289,"line_start":289}],"confidence":0.4,"description":"**Important:** `provision()` writes `WALLET_PRIVATE_KEY` to `.env` at runtime. If you use `import 'd","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility."},{"title":"Crypto seed/private key mention","locations":[{"file":"reference.md","line_end":306,"line_start":306}],"confidence":0.4,"description":"privateKey: process.env.WALLET_PRIVATE_KEY!,","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility."},{"title":"Generic API/secret keys","locations":[{"file":"SKILL.md","line_end":406,"line_start":406}],"confidence":0.4,"description":"// Reload .env to pick up WALLET_PRIVATE_KEY written by provision()","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility."},{"title":"Environment file access","locations":[{"file":"SKILL.md","line_end":406,"line_start":406}],"confidence":0.4,"description":"// Reload .env to pick up WALLET_PRIVATE_KEY written by provision()","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility."},{"title":"Crypto seed/private key mention","locations":[{"file":"SKILL.md","line_end":416,"line_start":416}],"confidence":0.4,"description":"privateKey: process.env.WALLET_PRIVATE_KEY!,","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility."},{"title":"Generic API/secret keys","locations":[{"file":"troubleshooting.md","line_end":143,"line_start":143}],"confidence":0.4,"description":"**Tip:** After `provision()` runs, the `WALLET_PRIVATE_KEY` is stored in `.env`. Use `dotenv.config(","review_kind":"capability","source_category":"env_access","source_severity":"high","confidence_reasoning":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility."},{"title":"Environment file access","locations":[{"file":"troubleshooting.md","line_end":143,"line_start":143}],"confidence":0.4,"description":"**Tip:** After `provision()` runs, the `WALLET_PRIVATE_KEY` is stored in `.env`. Use `dotenv.config(","review_kind":"security","source_category":"sensitive","source_severity":"high","confidence_reasoning":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility."}],"medium_findings":[],"low_findings":[{"title":"Documented runtime persistence of a crypto wallet private key to .env","locations":[{"file":"reference.md","line_end":289,"line_start":289},{"file":"reference.md","line_end":306,"line_start":306},{"file":"SKILL.md","line_end":416,"line_start":406}],"confidence":0.55,"description":"The reference and SKILL docs describe provision() writing WALLET_PRIVATE_KEY into the local .env file at runtime, then reloading it via dotenv.config({ override: true }), so the agent can sign on-chain ERC-8004 registration and x402/USDC payment transactions. This is transparent, intended SDK behavior documented for the developer — not covert exfiltration — but reviewers and users should understand that a spendable private key is stored in plaintext on disk and used to move funds on Base mainnet.","review_kind":"security","source_category":"semantic","source_severity":"low","confidence_reasoning":"The behavior is explicitly documented as an intended SDK feature for payments, so it is not malicious; the low-but-nonzero confidence reflects the genuine sensitivity of persisting a spendable private key to a plaintext .env rather than any sign of hidden intent."}],"dangerous_patterns":[],"files_scanned":12,"total_lines":1559,"audit_model":"claude","audited_at":"2026-07-21T04:24:39.859+00:00","created_at":"2026-07-21T04:43:46.351085+00:00","static_findings":[{"id":"external_commands:examples/basic-agent.ts:27:ruby-shell-backtick-execution","file":"examples/basic-agent.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Greeting: ${args.name}`)","category":"external_commands","line_end":27,"severity":"medium","line_start":27},{"id":"external_commands:examples/basic-agent.ts:28:ruby-shell-backtick-execution","file":"examples/basic-agent.ts","pattern":"Ruby/shell backtick execution","snippet":"return `Hello, ${args.name}! Welcome to OpenServ.`","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:examples/basic-agent.ts:54:ruby-shell-backtick-execution","file":"examples/basic-agent.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Webhook: https://api.openserv.ai/webhooks/trigger/${result.triggerToken}`)","category":"external_commands","line_end":54,"severity":"medium","line_start":54},{"id":"network:examples/basic-agent.ts:54:hardcoded-url","file":"examples/basic-agent.ts","pattern":"Hardcoded URL","snippet":"console.log(`Webhook: https://api.openserv.ai/webhooks/trigger/${result.triggerToken}`)","category":"network","line_end":54,"severity":"low","line_start":54},{"id":"env_access:examples/basic-agent.ts:9:dotenv-library","file":"examples/basic-agent.ts","pattern":"dotenv library","snippet":"import 'dotenv/config'","category":"env_access","line_end":9,"severity":"low","line_start":9},{"id":"external_commands:examples/capability-example.ts:39:ruby-shell-backtick-execution","file":"examples/capability-example.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Analyzing text (${depth} mode): \"${text.slice(0, 50)}...\"`)","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:examples/capability-example.ts:43:ruby-shell-backtick-execution","file":"examples/capability-example.ts","pattern":"Ruby/shell backtick execution","snippet":"prompt: `Analyze the following text. Provide ${","category":"external_commands","line_end":45,"severity":"medium","line_start":43},{"id":"external_commands:examples/capability-with-agent-methods.ts:34:ruby-shell-backtick-execution","file":"examples/capability-with-agent-methods.ts","pattern":"Ruby/shell backtick execution","snippet":"body: `Starting ${format} report on \"${topic}\"...`","category":"external_commands","line_end":34,"severity":"medium","line_start":34},{"id":"external_commands:examples/capability-with-agent-methods.ts:39:ruby-shell-backtick-execution","file":"examples/capability-with-agent-methods.ts","pattern":"Ruby/shell backtick execution","snippet":"prompt: `Generate a ${format} report on the following topic: ${topic}`,","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:examples/capability-with-agent-methods.ts:46:ruby-shell-backtick-execution","file":"examples/capability-with-agent-methods.ts","pattern":"Ruby/shell backtick execution","snippet":"path: `reports/${topic.replace(/\\s+/g, '-').toLowerCase()}.txt`,","category":"external_commands","line_end":46,"severity":"medium","line_start":46},{"id":"external_commands:examples/capability-with-agent-methods.ts:65:ruby-shell-backtick-execution","file":"examples/capability-with-agent-methods.ts","pattern":"Ruby/shell backtick execution","snippet":"prompt: `Generate a ${format} report on the following topic: ${topic}`,","category":"external_commands","line_end":65,"severity":"medium","line_start":65},{"id":"env_access:examples/env.example:3:generic-api-secret-keys","file":"examples/env.example","pattern":"Generic API/secret keys","snippet":"# OPENAI_API_KEY=your-openai-key","category":"env_access","line_end":3,"severity":"high","line_start":3},{"id":"env_access:examples/env.example:4:generic-api-secret-keys","file":"examples/env.example","pattern":"Generic API/secret keys","snippet":"# ANTHROPIC_API_KEY=your_anthropic_key  # If using Claude directly","category":"env_access","line_end":4,"severity":"high","line_start":4},{"id":"env_access:examples/env.example:7:generic-api-secret-keys","file":"examples/env.example","pattern":"Generic API/secret keys","snippet":"OPENSERV_USER_API_KEY=your-user-api-key","category":"env_access","line_end":7,"severity":"high","line_start":7},{"id":"env_access:examples/env.example:10:generic-api-secret-keys","file":"examples/env.example","pattern":"Generic API/secret keys","snippet":"WALLET_PRIVATE_KEY=","category":"env_access","line_end":10,"severity":"high","line_start":10},{"id":"env_access:examples/env.example:11:generic-api-secret-keys","file":"examples/env.example","pattern":"Generic API/secret keys","snippet":"OPENSERV_API_KEY=","category":"env_access","line_end":11,"severity":"high","line_start":11},{"id":"external_commands:examples/error-handling.ts:51:ruby-shell-backtick-execution","file":"examples/error-handling.ts","pattern":"Ruby/shell backtick execution","snippet":"body: `Error: ${error.message}`","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:examples/file-operations.ts:22:ruby-shell-backtick-execution","file":"examples/file-operations.ts","pattern":"Ruby/shell backtick execution","snippet":"return files.map(f => `- ${f.path} (${f.size} bytes)`).join('\\n') || 'No files found'","category":"external_commands","line_end":22,"severity":"medium","line_start":22},{"id":"external_commands:examples/file-operations.ts:43:ruby-shell-backtick-execution","file":"examples/file-operations.ts","pattern":"Ruby/shell backtick execution","snippet":"return `File saved: ${result.fullUrl}`","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:examples/file-operations.ts:61:ruby-shell-backtick-execution","file":"examples/file-operations.ts","pattern":"Ruby/shell backtick execution","snippet":"return `File ${args.fileId} deleted`","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"blocker:examples/file-operations.ts:20:system-reconnaissance","file":"examples/file-operations.ts","pattern":"System reconnaissance","snippet":"const files = await this.getFiles({ workspaceId: action.workspace.id })","category":"blocker","line_end":20,"severity":"low","line_start":20},{"id":"external_commands:examples/haiku-poet-agent.ts:53:ruby-shell-backtick-execution","file":"examples/haiku-poet-agent.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Paywall: ${result.paywallUrl}`)","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:examples/haiku-poet-agent.ts:54:ruby-shell-backtick-execution","file":"examples/haiku-poet-agent.ts","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Price: $0.01 per haiku`)","category":"external_commands","line_end":54,"severity":"medium","line_start":54},{"id":"env_access:examples/haiku-poet-agent.ts:9:dotenv-library","file":"examples/haiku-poet-agent.ts","pattern":"dotenv library","snippet":"import 'dotenv/config'","category":"env_access","line_end":9,"severity":"low","line_start":9},{"id":"blocker:examples/haiku-poet-agent.ts:4:system-reconnaissance","file":"examples/haiku-poet-agent.ts","pattern":"System reconnaissance","snippet":"* A paid agent that generates haikus — no LLM API key needed!","category":"blocker","line_end":4,"severity":"low","line_start":4},{"id":"external_commands:examples/multiple-capabilities.ts:41:ruby-shell-backtick-execution","file":"examples/multiple-capabilities.ts","pattern":"Ruby/shell backtick execution","snippet":"prompt: `Translate the following text to ${args.targetLanguage}. Output only the translation, nothin","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:examples/task-management.ts:44:ruby-shell-backtick-execution","file":"examples/task-management.ts","pattern":"Ruby/shell backtick execution","snippet":"const result = `Processed: ${args.data}`","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:examples/task-management.ts:97:ruby-shell-backtick-execution","file":"examples/task-management.ts","pattern":"Ruby/shell backtick execution","snippet":"return `Created task ${newTask.id}`","category":"external_commands","line_end":97,"severity":"medium","line_start":97},{"id":"blocker:examples/task-management.ts:84:system-reconnaissance","file":"examples/task-management.ts","pattern":"System reconnaissance","snippet":"const agents = await this.getAgents({ workspaceId: workspace.id })","category":"blocker","line_end":84,"severity":"low","line_start":84},{"id":"blocker:examples/task-management.ts:89:system-reconnaissance","file":"examples/task-management.ts","pattern":"System reconnaissance","snippet":"assignee: agents[0]?.id || me.id,","category":"blocker","line_end":89,"severity":"low","line_start":89},{"id":"external_commands:reference.md:121:ruby-shell-backtick-execution","file":"reference.md","pattern":"Ruby/shell backtick execution","snippet":"prompt: `Create a compelling ${args.platform} post about: ${args.topic}`,","category":"external_commands","line_end":127,"severity":"medium","line_start":121},{"id":"external_commands:reference.md:127:ruby-shell-backtick-execution","file":"reference.md","pattern":"Ruby/shell backtick execution","snippet":"prompt: `Suggest 3 hashtags for: ${post}`,","category":"external_commands","line_end":134,"severity":"medium","line_start":127},{"id":"external_commands:reference.md:134:ruby-shell-backtick-execution","file":"reference.md","pattern":"Ruby/shell backtick execution","snippet":"return `${post}\\n\\n${metadata.hashtags.map(t => `#${t}`).join(' ')}`","category":"external_commands","line_end":134,"severity":"medium","line_start":134},{"id":"external_commands:reference.md:278:ruby-shell-backtick-execution","file":"reference.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Added ${result.creditsAdded} credits`)","category":"external_commands","line_end":283,"severity":"medium","line_start":278},{"id":"network:reference.md:265:hardcoded-url","file":"reference.md","pattern":"Hardcoded URL","snippet":"triggerUrl: 'https://api.openserv.ai/webhooks/x402/trigger/...',","category":"network","line_end":265,"severity":"low","line_start":265},{"id":"network:reference.md:310:hardcoded-url","file":"reference.md","pattern":"Hardcoded URL","snippet":"// rpcUrl: 'https://mainnet.base.org' // Default","category":"network","line_end":310,"severity":"low","line_start":310},{"id":"network:reference.md:315:hardcoded-url","file":"reference.md","pattern":"Hardcoded URL","snippet":"erc8004.blockExplorerUrl // \"https://basescan.org/tx/...\"","category":"network","line_end":315,"severity":"low","line_start":315},{"id":"network:reference.md:317:hardcoded-url","file":"reference.md","pattern":"Hardcoded URL","snippet":"erc8004.scanUrl          // \"https://www.8004scan.io/agents/base/42\"","category":"network","line_end":317,"severity":"low","line_start":317},{"id":"network:reference.md:344:hardcoded-url","file":"reference.md","pattern":"Hardcoded URL","snippet":"OPENSERV_PROXY_URL=...     # Custom proxy URL (default: https://agents-proxy.openserv.ai)","category":"network","line_end":344,"severity":"low","line_start":344},{"id":"env_access:reference.md:302:environment-variable-access-dot-notation","file":"reference.md","pattern":"Environment variable access (dot notation)","snippet":"await client.authenticate(process.env.WALLET_PRIVATE_KEY)","category":"env_access","line_end":302,"severity":"low","line_start":302},{"id":"env_access:reference.md:306:environment-variable-access-dot-notation","file":"reference.md","pattern":"Environment variable access (dot notation)","snippet":"privateKey: process.env.WALLET_PRIVATE_KEY!,","category":"env_access","line_end":306,"severity":"low","line_start":306},{"id":"env_access:reference.md:302:environment-variable-object","file":"reference.md","pattern":"Environment variable object","snippet":"await client.authenticate(process.env.WALLET_PRIVATE_KEY)","category":"env_access","line_end":302,"severity":"low","line_start":302},{"id":"env_access:reference.md:306:environment-variable-object","file":"reference.md","pattern":"Environment variable object","snippet":"privateKey: process.env.WALLET_PRIVATE_KEY!,","category":"env_access","line_end":306,"severity":"low","line_start":306},{"id":"env_access:reference.md:30:dotenv-library","file":"reference.md","pattern":"dotenv library","snippet":"import 'dotenv/config'","category":"env_access","line_end":30,"severity":"low","line_start":30},{"id":"env_access:reference.md:289:dotenv-library","file":"reference.md","pattern":"dotenv library","snippet":"**Important:** `provision()` writes `WALLET_PRIVATE_KEY` to `.env` at runtime. If you use `import 'd","category":"env_access","line_end":289,"severity":"low","line_start":289},{"id":"env_access:reference.md:292:dotenv-library","file":"reference.md","pattern":"dotenv library","snippet":"import dotenv from 'dotenv'","category":"env_access","line_end":292,"severity":"low","line_start":292},{"id":"env_access:reference.md:293:dotenv-library","file":"reference.md","pattern":"dotenv library","snippet":"dotenv.config()","category":"env_access","line_end":293,"severity":"low","line_start":293},{"id":"env_access:reference.md:298:dotenv-library","file":"reference.md","pattern":"dotenv library","snippet":"dotenv.config({ override: true })","category":"env_access","line_end":298,"severity":"low","line_start":298},{"id":"env_access:reference.md:276:generic-api-secret-keys","file":"reference.md","pattern":"Generic API/secret keys","snippet":"// Top up credits with USDC (uses WALLET_PRIVATE_KEY env var)","category":"env_access","line_end":276,"severity":"high","line_start":276},{"id":"env_access:reference.md:289:generic-api-secret-keys","file":"reference.md","pattern":"Generic API/secret keys","snippet":"**Important:** `provision()` writes `WALLET_PRIVATE_KEY` to `.env` at runtime. If you use `import 'd","category":"env_access","line_end":289,"severity":"high","line_start":289},{"id":"env_access:reference.md:297:generic-api-secret-keys","file":"reference.md","pattern":"Generic API/secret keys","snippet":"// Reload .env to pick up WALLET_PRIVATE_KEY written by provision()","category":"env_access","line_end":297,"severity":"high","line_start":297},{"id":"env_access:reference.md:302:generic-api-secret-keys","file":"reference.md","pattern":"Generic API/secret keys","snippet":"await client.authenticate(process.env.WALLET_PRIVATE_KEY)","category":"env_access","line_end":302,"severity":"high","line_start":302},{"id":"env_access:reference.md:306:generic-api-secret-keys","file":"reference.md","pattern":"Generic API/secret keys","snippet":"privateKey: process.env.WALLET_PRIVATE_KEY!,","category":"env_access","line_end":306,"severity":"high","line_start":306},{"id":"env_access:reference.md:331:generic-api-secret-keys","file":"reference.md","pattern":"Generic API/secret keys","snippet":"Most agents don't need any LLM API key—use runless capabilities or `generate()`. Only set `OPENAI_AP","category":"env_access","line_end":331,"severity":"high","line_start":331},{"id":"env_access:reference.md:335:generic-api-secret-keys","file":"reference.md","pattern":"Generic API/secret keys","snippet":"# OPENAI_API_KEY=your-key","category":"env_access","line_end":335,"severity":"high","line_start":335},{"id":"env_access:reference.md:336:generic-api-secret-keys","file":"reference.md","pattern":"Generic API/secret keys","snippet":"# ANTHROPIC_API_KEY=your_anthropic_key  # If using Claude directly","category":"env_access","line_end":336,"severity":"high","line_start":336},{"id":"env_access:reference.md:338:generic-api-secret-keys","file":"reference.md","pattern":"Generic API/secret keys","snippet":"OPENSERV_API_KEY=auto-populated","category":"env_access","line_end":338,"severity":"high","line_start":338},{"id":"env_access:reference.md:340:generic-api-secret-keys","file":"reference.md","pattern":"Generic API/secret keys","snippet":"WALLET_PRIVATE_KEY=auto-populated (also used for x402 payments, USDC top-up, and ERC-8004 registrati","category":"env_access","line_end":340,"severity":"high","line_start":340},{"id":"sensitive:reference.md:289:environment-file-access","file":"reference.md","pattern":"Environment file access","snippet":"**Important:** `provision()` writes `WALLET_PRIVATE_KEY` to `.env` at runtime. If you use `import 'd","category":"sensitive","line_end":289,"severity":"high","line_start":289},{"id":"sensitive:reference.md:297:environment-file-access","file":"reference.md","pattern":"Environment file access","snippet":"// Reload .env to pick up WALLET_PRIVATE_KEY written by provision()","category":"sensitive","line_end":297,"severity":"high","line_start":297},{"id":"sensitive:reference.md:302:environment-file-access","file":"reference.md","pattern":"Environment file access","snippet":"await client.authenticate(process.env.WALLET_PRIVATE_KEY)","category":"sensitive","line_end":302,"severity":"high","line_start":302},{"id":"sensitive:reference.md:306:environment-file-access","file":"reference.md","pattern":"Environment file access","snippet":"privateKey: process.env.WALLET_PRIVATE_KEY!,","category":"sensitive","line_end":306,"severity":"high","line_start":306},{"id":"sensitive:reference.md:306:crypto-seed-private-key-mention","file":"reference.md","pattern":"Crypto seed/private key mention","snippet":"privateKey: process.env.WALLET_PRIVATE_KEY!,","category":"sensitive","line_end":306,"severity":"high","line_start":306},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"An OpenServ agent is a service that runs your code and exposes it on the OpenServ platform—so it can","category":"external_commands","line_end":12,"severity":"medium","line_start":12},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Define your agent** — System prompt plus _capabilities_. Capabilities come in two flavors: **ru","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Register with the platform** — You need an account on the platform; often the easiest way is to","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **Start the agent** — Call `run(agent)`. The agent listens for tasks, runs your capabilities (and","category":"external_commands","line_end":18,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Runless Capabilities** — Just a name and description. The platform handles the AI call automatic","category":"external_commands","line_end":22,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Runnable Capabilities** — The tools your agent can run (e.g. search, transform data, call APIs).","category":"external_commands","line_end":23,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`generate()` method** — Delegate LLM calls to the platform from inside any runnable capability. ","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Task context** — When running in a task, the agent can attach logs and uploads to that task via ","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Reference:** `reference.md` (patterns) · `troubleshooting.md` (common issues) · `examples/` (full ","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":36,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":38,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Note:** `openai` is only needed if you use the `process()` method for direct OpenAI calls. Most ","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"See `examples/basic-agent.ts` for a complete runnable example.","category":"external_commands","line_end":46,"severity":"medium","line_start":42},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Create an `Agent` with a system prompt","category":"external_commands","line_end":47,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Add capabilities with `agent.addCapability()`","category":"external_commands","line_end":48,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. Call `provision()` to register on the platform (pass `agent.instance` to bind credentials)","category":"external_commands","line_end":48,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. Call `run(agent)` to start","category":"external_commands","line_end":57,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":64,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":68,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":72,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":74,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Note:** The project must use `\"type\": \"module\"` in `package.json`. Add a `\"dev\": \"tsx src/agent.","category":"external_commands","line_end":74,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Most agents don't need any LLM API key—use **runless capabilities** or `generate()` and the platform","category":"external_commands","line_end":78,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```env","category":"external_commands","line_end":97,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":107,"severity":"medium","line_start":97},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Runless capabilities don't need a `run` function—the platform handles the AI call automatically. Jus","category":"external_commands","line_end":109,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":135,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":137,"severity":"medium","line_start":135},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **No `run` function** — the platform performs the LLM call","category":"external_commands","line_end":139,"severity":"medium","line_start":137},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `inputSchema` is optional — defaults to `z.object({ input: z.string() })` if omitted","category":"external_commands","line_end":139,"severity":"medium","line_start":139},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `outputSchema` is optional — define it for structured output from the platform","category":"external_commands","line_end":142,"severity":"medium","line_start":140},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"See `examples/haiku-poet-agent.ts` for a complete runless example.","category":"external_commands","line_end":146,"severity":"medium","line_start":142},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Runnable capabilities have a `run` function for custom logic. Each requires:","category":"external_commands","line_end":148,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `name` - Unique identifier","category":"external_commands","line_end":149,"severity":"medium","line_start":148},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `description` - What it does (helps AI decide when to use it)","category":"external_commands","line_end":150,"severity":"medium","line_start":149},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `inputSchema` - Zod schema defining parameters","category":"external_commands","line_end":151,"severity":"medium","line_start":150},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `run` - Function returning a string","category":"external_commands","line_end":153,"severity":"medium","line_start":151},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":159,"severity":"medium","line_start":153},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"return `Hello, ${args.name}!`","category":"external_commands","line_end":162,"severity":"medium","line_start":159},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":164,"severity":"medium","line_start":162},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"See `examples/capability-example.ts` for basic capabilities.","category":"external_commands","line_end":166,"severity":"medium","line_start":164},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Note:** The `schema` property still works as an alias for `inputSchema` but is deprecated. Use `","category":"external_commands","line_end":166,"severity":"medium","line_start":166},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Access `this` in capabilities to use agent methods like `addLogToTask()`, `uploadFile()`, `generate(","category":"external_commands","line_end":170,"severity":"medium","line_start":170},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"See `examples/capability-with-agent-methods.ts` for logging and file upload patterns.","category":"external_commands","line_end":178,"severity":"medium","line_start":172},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### `generate()` — Platform-Delegated LLM Calls","category":"external_commands","line_end":180,"severity":"medium","line_start":178},{"id":"external_commands:SKILL.md:180:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The `generate()` method lets you make LLM calls without any API key. The platform performs the call ","category":"external_commands","line_end":182,"severity":"medium","line_start":180},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":185,"severity":"medium","line_start":182},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"prompt: `Write a short poem about ${args.topic}`,","category":"external_commands","line_end":191,"severity":"medium","line_start":185},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"prompt: `Suggest a title and 3 tags for: ${poem}`,","category":"external_commands","line_end":205,"severity":"medium","line_start":191},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":208,"severity":"medium","line_start":205},{"id":"external_commands:SKILL.md:208:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `prompt` (string) — The prompt for the LLM","category":"external_commands","line_end":209,"severity":"medium","line_start":208},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `action` (ActionSchema) — The action context (passed into your `run` function)","category":"external_commands","line_end":209,"severity":"medium","line_start":209},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `outputSchema` (Zod schema, optional) — When provided, returns a validated structured output","category":"external_commands","line_end":211,"severity":"medium","line_start":210},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `messages` (array, optional) — Conversation history for multi-turn generation","category":"external_commands","line_end":213,"severity":"medium","line_start":211},{"id":"external_commands:SKILL.md:213:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The `action` parameter is required because it identifies the workspace/task for billing. Use it insi","category":"external_commands","line_end":213,"severity":"medium","line_start":213},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":224,"severity":"medium","line_start":217},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":228,"severity":"medium","line_start":224},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":232,"severity":"medium","line_start":228},{"id":"external_commands:SKILL.md:232:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":238,"severity":"medium","line_start":232},{"id":"external_commands:SKILL.md:238:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The `action` parameter in capabilities is a **union type** — `task` only exists on the `'do-task'` v","category":"external_commands","line_end":238,"severity":"medium","line_start":238},{"id":"external_commands:SKILL.md:240:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":253,"severity":"medium","line_start":240},{"id":"external_commands:SKILL.md:253:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":255,"severity":"medium","line_start":253},{"id":"external_commands:SKILL.md:255:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Do not** extract `action?.task?.id` before the type guard — TypeScript will error with `Property '","category":"external_commands","line_end":255,"severity":"medium","line_start":255},{"id":"external_commands:SKILL.md:261:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The `workflow` object in `provision()` requires two important properties:","category":"external_commands","line_end":261,"severity":"medium","line_start":261},{"id":"external_commands:SKILL.md:263:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`name`** (string) - This becomes the **agent name in ERC-8004**. Make it polished, punchy, and m","category":"external_commands","line_end":263,"severity":"medium","line_start":263},{"id":"external_commands:SKILL.md:264:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`goal`** (string, required) - A detailed description of what the workflow accomplishes. Must be ","category":"external_commands","line_end":266,"severity":"medium","line_start":264},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":273,"severity":"medium","line_start":266},{"id":"external_commands:SKILL.md:273:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":279,"severity":"medium","line_start":273},{"id":"external_commands:SKILL.md:279:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":286,"severity":"medium","line_start":279},{"id":"external_commands:SKILL.md:286:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":288,"severity":"medium","line_start":286},{"id":"external_commands:SKILL.md:288:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Important:** Always set `timeout` to at least **600 seconds** (10 minutes) for webhook and x402 ","category":"external_commands","line_end":292,"severity":"medium","line_start":288},{"id":"external_commands:SKILL.md:292:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`provision()` creates two types of credentials. They are **not interchangeable**:","category":"external_commands","line_end":294,"severity":"medium","line_start":292},{"id":"external_commands:SKILL.md:294:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`OPENSERV_API_KEY`** (Agent API key) — Used internally by the SDK to authenticate when receiving","category":"external_commands","line_end":294,"severity":"medium","line_start":294},{"id":"external_commands:SKILL.md:295:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`WALLET_PRIVATE_KEY`** / **`OPENSERV_USER_API_KEY`** (User credentials) — Used with `PlatformCli","category":"external_commands","line_end":295,"severity":"medium","line_start":295},{"id":"external_commands:SKILL.md:299:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":303,"severity":"medium","line_start":299},{"id":"external_commands:SKILL.md:303:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":305,"severity":"medium","line_start":303},{"id":"external_commands:SKILL.md:305:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"See `troubleshooting.md` for details on 401 errors.","category":"external_commands","line_end":313,"severity":"medium","line_start":305},{"id":"external_commands:SKILL.md:313:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":315,"severity":"medium","line_start":313},{"id":"external_commands:SKILL.md:315:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":317,"severity":"medium","line_start":315},{"id":"external_commands:SKILL.md:317:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The `run()` function automatically:","category":"external_commands","line_end":320,"severity":"medium","line_start":317},{"id":"external_commands:SKILL.md:320:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Connects via WebSocket to `agents-proxy.openserv.ai`","category":"external_commands","line_end":323,"severity":"medium","line_start":320},{"id":"external_commands:SKILL.md:323:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**No need for ngrok or other tunneling tools** - `run()` handles this seamlessly. Just call `run(age","category":"external_commands","line_end":323,"severity":"medium","line_start":323},{"id":"external_commands:SKILL.md:329:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":331,"severity":"medium","line_start":329},{"id":"external_commands:SKILL.md:331:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":333,"severity":"medium","line_start":331},{"id":"external_commands:SKILL.md:333:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Where `[path]` is the directory containing your agent code (defaults to current directory).","category":"external_commands","line_end":337,"severity":"medium","line_start":333},{"id":"external_commands:SKILL.md:337:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **`OPENSERV_USER_API_KEY` in `.env`** — Your `.env` file in the agent directory must contain `OPE","category":"external_commands","line_end":337,"severity":"medium","line_start":337},{"id":"external_commands:SKILL.md:339:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Call `provision()` first** — `provision()` must run at least once before deploying. It register","category":"external_commands","line_end":339,"severity":"medium","line_start":339},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```text","category":"external_commands","line_end":347,"severity":"medium","line_start":343},{"id":"external_commands:SKILL.md:347:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":351,"severity":"medium","line_start":347},{"id":"external_commands:SKILL.md:351:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"When deploying to a hosting provider like Cloud Run, set `DISABLE_TUNNEL=true` as an environment var","category":"external_commands","line_end":351,"severity":"medium","line_start":351},{"id":"external_commands:SKILL.md:353:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":370,"severity":"medium","line_start":353},{"id":"external_commands:SKILL.md:370:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":378,"severity":"medium","line_start":370},{"id":"external_commands:SKILL.md:378:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Requires ETH on Base.** Registration calls `register()` on the ERC-8004 contract on **Base mainn","category":"external_commands","line_end":378,"severity":"medium","line_start":378},{"id":"external_commands:SKILL.md:380:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> **Always wrap in try/catch** so a registration failure (e.g. unfunded wallet) doesn't prevent `run","category":"external_commands","line_end":384,"severity":"medium","line_start":380},{"id":"external_commands:SKILL.md:384:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Use `dotenv` programmatically** (not `import 'dotenv/config'`) so you can reload `.env` after `","category":"external_commands","line_end":384,"severity":"medium","line_start":384},{"id":"external_commands:SKILL.md:385:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Call `dotenv.config({ override: true })` after `provision()`** to pick up the freshly written k","category":"external_commands","line_end":385,"severity":"medium","line_start":385},{"id":"external_commands:SKILL.md:387:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":421,"severity":"medium","line_start":387},{"id":"external_commands:SKILL.md:421:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Agent ID: ${erc8004.agentId}`) // \"8453:42\"","category":"external_commands","line_end":422,"severity":"medium","line_start":421},{"id":"external_commands:SKILL.md:422:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`TX: ${erc8004.blockExplorerUrl}`)","category":"external_commands","line_end":423,"severity":"medium","line_start":422},{"id":"external_commands:SKILL.md:423:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"console.log(`Scan: ${erc8004.scanUrl}`) // \"https://www.8004scan.io/agents/base/42\"","category":"external_commands","line_end":429,"severity":"medium","line_start":423},{"id":"external_commands:SKILL.md:429:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":433,"severity":"medium","line_start":429},{"id":"external_commands:SKILL.md:433:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Default chain: Base mainnet (8453). Pass `chainId` / `rpcUrl` for others.","category":"external_commands","line_end":433,"severity":"medium","line_start":433},{"id":"external_commands:SKILL.md:441:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`this.process()`** inside capabilities — Legacy method requiring an OpenAI API key. Use `this.ge","category":"external_commands","line_end":441,"severity":"medium","line_start":441},{"id":"external_commands:SKILL.md:442:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`doTask` override** — The SDK handles task execution automatically","category":"external_commands","line_end":443,"severity":"medium","line_start":442},{"id":"external_commands:SKILL.md:443:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`this.completeTask()`** — Task completion is handled by the Runtime API","category":"external_commands","line_end":451,"severity":"medium","line_start":443},{"id":"external_commands:SKILL.md:451:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":457,"severity":"medium","line_start":451},{"id":"external_commands:SKILL.md:457:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":461,"severity":"medium","line_start":457},{"id":"external_commands:SKILL.md:461:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":463,"severity":"medium","line_start":461},{"id":"network:SKILL.md:358:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"endpointUrl: 'https://my-agent.example.com' // Required for production","category":"network","line_end":358,"severity":"low","line_start":358},{"id":"network:SKILL.md:423:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"console.log(`Scan: ${erc8004.scanUrl}`) // \"https://www.8004scan.io/agents/base/42\"","category":"network","line_end":423,"severity":"low","line_start":423},{"id":"env_access:SKILL.md:301:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"await client.authenticate(process.env.WALLET_PRIVATE_KEY)","category":"env_access","line_end":301,"severity":"low","line_start":301},{"id":"env_access:SKILL.md:412:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"await client.authenticate(process.env.WALLET_PRIVATE_KEY)","category":"env_access","line_end":412,"severity":"low","line_start":412},{"id":"env_access:SKILL.md:416:environment-variable-access-dot-notation","file":"SKILL.md","pattern":"Environment variable access (dot notation)","snippet":"privateKey: process.env.WALLET_PRIVATE_KEY!,","category":"env_access","line_end":416,"severity":"low","line_start":416},{"id":"env_access:SKILL.md:301:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"await client.authenticate(process.env.WALLET_PRIVATE_KEY)","category":"env_access","line_end":301,"severity":"low","line_start":301},{"id":"env_access:SKILL.md:412:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"await client.authenticate(process.env.WALLET_PRIVATE_KEY)","category":"env_access","line_end":412,"severity":"low","line_start":412},{"id":"env_access:SKILL.md:416:environment-variable-object","file":"SKILL.md","pattern":"Environment variable object","snippet":"privateKey: process.env.WALLET_PRIVATE_KEY!,","category":"env_access","line_end":416,"severity":"low","line_start":416},{"id":"env_access:SKILL.md:70:dotenv-library","file":"SKILL.md","pattern":"dotenv library","snippet":"npm i @openserv-labs/sdk @openserv-labs/client dotenv zod","category":"env_access","line_end":70,"severity":"low","line_start":70},{"id":"env_access:SKILL.md:384:dotenv-library","file":"SKILL.md","pattern":"dotenv library","snippet":"1. **Use `dotenv` programmatically** (not `import 'dotenv/config'`) so you can reload `.env` after `","category":"env_access","line_end":384,"severity":"low","line_start":384},{"id":"env_access:SKILL.md:385:dotenv-library","file":"SKILL.md","pattern":"dotenv library","snippet":"2. **Call `dotenv.config({ override: true })` after `provision()`** to pick up the freshly written k","category":"env_access","line_end":385,"severity":"low","line_start":385},{"id":"env_access:SKILL.md:388:dotenv-library","file":"SKILL.md","pattern":"dotenv library","snippet":"import dotenv from 'dotenv'","category":"env_access","line_end":388,"severity":"low","line_start":388},{"id":"env_access:SKILL.md:389:dotenv-library","file":"SKILL.md","pattern":"dotenv library","snippet":"dotenv.config()","category":"env_access","line_end":389,"severity":"low","line_start":389},{"id":"env_access:SKILL.md:407:dotenv-library","file":"SKILL.md","pattern":"dotenv library","snippet":"dotenv.config({ override: true })","category":"env_access","line_end":407,"severity":"low","line_start":407},{"id":"env_access:SKILL.md:78:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"Most agents don't need any LLM API key—use **runless capabilities** or `generate()` and the platform","category":"env_access","line_end":78,"severity":"high","line_start":78},{"id":"env_access:SKILL.md:82:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"# OPENAI_API_KEY=your-openai-key","category":"env_access","line_end":82,"severity":"high","line_start":82},{"id":"env_access:SKILL.md:83:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"# ANTHROPIC_API_KEY=your_anthropic_key  # If using Claude directly","category":"env_access","line_end":83,"severity":"high","line_start":83},{"id":"env_access:SKILL.md:86:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"OPENSERV_USER_API_KEY=your-user-api-key","category":"env_access","line_end":86,"severity":"high","line_start":86},{"id":"env_access:SKILL.md:89:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"WALLET_PRIVATE_KEY=","category":"env_access","line_end":89,"severity":"high","line_start":89},{"id":"env_access:SKILL.md:90:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"OPENSERV_API_KEY=","category":"env_access","line_end":90,"severity":"high","line_start":90},{"id":"env_access:SKILL.md:294:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"- **`OPENSERV_API_KEY`** (Agent API key) — Used internally by the SDK to authenticate when receiving","category":"env_access","line_end":294,"severity":"high","line_start":294},{"id":"env_access:SKILL.md:295:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"- **`WALLET_PRIVATE_KEY`** / **`OPENSERV_USER_API_KEY`** (User credentials) — Used with `PlatformCli","category":"env_access","line_end":295,"severity":"high","line_start":295},{"id":"env_access:SKILL.md:301:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"await client.authenticate(process.env.WALLET_PRIVATE_KEY)","category":"env_access","line_end":301,"severity":"high","line_start":301},{"id":"env_access:SKILL.md:337:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"1. **`OPENSERV_USER_API_KEY` in `.env`** — Your `.env` file in the agent directory must contain `OPE","category":"env_access","line_end":337,"severity":"high","line_start":337},{"id":"env_access:SKILL.md:344:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"1. Set OPENSERV_USER_API_KEY in .env","category":"env_access","line_end":344,"severity":"high","line_start":344},{"id":"env_access:SKILL.md:384:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"1. **Use `dotenv` programmatically** (not `import 'dotenv/config'`) so you can reload `.env` after `","category":"env_access","line_end":384,"severity":"high","line_start":384},{"id":"env_access:SKILL.md:406:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"// Reload .env to pick up WALLET_PRIVATE_KEY written by provision()","category":"env_access","line_end":406,"severity":"high","line_start":406},{"id":"env_access:SKILL.md:412:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"await client.authenticate(process.env.WALLET_PRIVATE_KEY)","category":"env_access","line_end":412,"severity":"high","line_start":412},{"id":"env_access:SKILL.md:416:generic-api-secret-keys","file":"SKILL.md","pattern":"Generic API/secret keys","snippet":"privateKey: process.env.WALLET_PRIVATE_KEY!,","category":"env_access","line_end":416,"severity":"high","line_start":416},{"id":"sensitive:SKILL.md:60:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"├── .env","category":"sensitive","line_end":60,"severity":"high","line_start":60},{"id":"sensitive:SKILL.md:76:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"### .env","category":"sensitive","line_end":76,"severity":"high","line_start":76},{"id":"sensitive:SKILL.md:301:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"await client.authenticate(process.env.WALLET_PRIVATE_KEY)","category":"sensitive","line_end":301,"severity":"high","line_start":301},{"id":"sensitive:SKILL.md:337:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"1. **`OPENSERV_USER_API_KEY` in `.env`** — Your `.env` file in the agent directory must contain `OPE","category":"sensitive","line_end":337,"severity":"high","line_start":337},{"id":"sensitive:SKILL.md:344:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"1. Set OPENSERV_USER_API_KEY in .env","category":"sensitive","line_end":344,"severity":"high","line_start":344},{"id":"sensitive:SKILL.md:384:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"1. **Use `dotenv` programmatically** (not `import 'dotenv/config'`) so you can reload `.env` after `","category":"sensitive","line_end":384,"severity":"high","line_start":384},{"id":"sensitive:SKILL.md:406:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"// Reload .env to pick up WALLET_PRIVATE_KEY written by provision()","category":"sensitive","line_end":406,"severity":"high","line_start":406},{"id":"sensitive:SKILL.md:412:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"await client.authenticate(process.env.WALLET_PRIVATE_KEY)","category":"sensitive","line_end":412,"severity":"high","line_start":412},{"id":"sensitive:SKILL.md:416:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"privateKey: process.env.WALLET_PRIVATE_KEY!,","category":"sensitive","line_end":416,"severity":"high","line_start":416},{"id":"sensitive:SKILL.md:416:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"privateKey: process.env.WALLET_PRIVATE_KEY!,","category":"sensitive","line_end":416,"severity":"high","line_start":416},{"id":"blocker:SKILL.md:12:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"An OpenServ agent is a service that runs your code and exposes it on the OpenServ platform—so it can","category":"blocker","line_end":12,"severity":"low","line_start":12},{"id":"blocker:SKILL.md:245:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"workspace.id        // Workspace ID","category":"blocker","line_end":245,"severity":"low","line_start":245},{"id":"blocker:SKILL.md:247:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"task.id             // Task ID","category":"blocker","line_end":247,"severity":"low","line_start":247},{"id":"blocker:SKILL.md:250:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"action.me.id        // Current agent ID","category":"blocker","line_end":250,"severity":"low","line_start":250},{"id":"scripts:troubleshooting.md:175:dynamic-import-expression","file":"troubleshooting.md","pattern":"Dynamic import() expression","snippet":"**If you must use CommonJS** (no `\"type\": \"module\"`), use dynamic `import()`:","category":"scripts","line_end":175,"severity":"medium","line_start":175},{"id":"scripts:troubleshooting.md:179:dynamic-import-expression","file":"troubleshooting.md","pattern":"Dynamic import() expression","snippet":"const { Agent, run } = await import('@openserv-labs/sdk')","category":"scripts","line_end":179,"severity":"medium","line_start":179},{"id":"scripts:troubleshooting.md:180:dynamic-import-expression","file":"troubleshooting.md","pattern":"Dynamic import() expression","snippet":"const { provision, triggers } = await import('@openserv-labs/client')","category":"scripts","line_end":180,"severity":"medium","line_start":180},{"id":"scripts:troubleshooting.md:186:dynamic-require-with-variable","file":"troubleshooting.md","pattern":"Dynamic require with variable","snippet":"**Do not** mix `require()` with ESM-only packages. If you see `ERR_REQUIRE_ESM`, switch to `\"type\": ","category":"scripts","line_end":186,"severity":"medium","line_start":186},{"id":"external_commands:troubleshooting.md:37:xargs-command-can-execute-arbitrary-commands","file":"troubleshooting.md","pattern":"xargs command (can execute arbitrary commands)","snippet":"lsof -ti:7378 | xargs kill -9","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"env_access:troubleshooting.md:135:environment-variable-access-dot-notation","file":"troubleshooting.md","pattern":"Environment variable access (dot notation)","snippet":"await client.authenticate(process.env.WALLET_PRIVATE_KEY)","category":"env_access","line_end":135,"severity":"low","line_start":135},{"id":"env_access:troubleshooting.md:139:environment-variable-access-dot-notation","file":"troubleshooting.md","pattern":"Environment variable access (dot notation)","snippet":"apiKey: process.env.OPENSERV_USER_API_KEY // NOT OPENSERV_API_KEY","category":"env_access","line_end":139,"severity":"low","line_start":139},{"id":"env_access:troubleshooting.md:104:environment-variable-object","file":"troubleshooting.md","pattern":"Environment variable object","snippet":"**Cause:** `WALLET_PRIVATE_KEY` is empty. `provision()` writes it to `.env` at runtime, but `process","category":"env_access","line_end":104,"severity":"low","line_start":104},{"id":"env_access:troubleshooting.md:135:environment-variable-object","file":"troubleshooting.md","pattern":"Environment variable object","snippet":"await client.authenticate(process.env.WALLET_PRIVATE_KEY)","category":"env_access","line_end":135,"severity":"low","line_start":135},{"id":"env_access:troubleshooting.md:139:environment-variable-object","file":"troubleshooting.md","pattern":"Environment variable object","snippet":"apiKey: process.env.OPENSERV_USER_API_KEY // NOT OPENSERV_API_KEY","category":"env_access","line_end":139,"severity":"low","line_start":139},{"id":"env_access:troubleshooting.md:106:dotenv-library","file":"troubleshooting.md","pattern":"dotenv library","snippet":"**Solution:** Use `dotenv` programmatically and reload after `provision()`:","category":"env_access","line_end":106,"severity":"low","line_start":106},{"id":"env_access:troubleshooting.md:109:dotenv-library","file":"troubleshooting.md","pattern":"dotenv library","snippet":"import dotenv from 'dotenv'","category":"env_access","line_end":109,"severity":"low","line_start":109},{"id":"env_access:troubleshooting.md:110:dotenv-library","file":"troubleshooting.md","pattern":"dotenv library","snippet":"dotenv.config()","category":"env_access","line_end":110,"severity":"low","line_start":110},{"id":"env_access:troubleshooting.md:114:dotenv-library","file":"troubleshooting.md","pattern":"dotenv library","snippet":"dotenv.config({ override: true }) // reload to pick up WALLET_PRIVATE_KEY","category":"env_access","line_end":114,"severity":"low","line_start":114},{"id":"env_access:troubleshooting.md:117:dotenv-library","file":"troubleshooting.md","pattern":"dotenv library","snippet":"Do **not** use `import 'dotenv/config'` — it only loads `.env` once at import time and cannot be rel","category":"env_access","line_end":117,"severity":"low","line_start":117},{"id":"env_access:troubleshooting.md:143:dotenv-library","file":"troubleshooting.md","pattern":"dotenv library","snippet":"**Tip:** After `provision()` runs, the `WALLET_PRIVATE_KEY` is stored in `.env`. Use `dotenv.config(","category":"env_access","line_end":143,"severity":"low","line_start":143},{"id":"env_access:troubleshooting.md:9:generic-api-secret-keys","file":"troubleshooting.md","pattern":"Generic API/secret keys","snippet":"**Error:** `Error: OpenServ API key is required. Please provide it in options, set OPENSERV_API_KEY ","category":"env_access","line_end":9,"severity":"high","line_start":9},{"id":"env_access:troubleshooting.md:80:generic-api-secret-keys","file":"troubleshooting.md","pattern":"Generic API/secret keys","snippet":"`OPENAI_API_KEY` is only needed if you use the `process()` method for direct OpenAI calls. Most agen","category":"env_access","line_end":80,"severity":"high","line_start":80},{"id":"env_access:troubleshooting.md:84:generic-api-secret-keys","file":"troubleshooting.md","pattern":"Generic API/secret keys","snippet":"- Verify `OPENAI_API_KEY` is set correctly","category":"env_access","line_end":84,"severity":"high","line_start":84},{"id":"env_access:troubleshooting.md:104:generic-api-secret-keys","file":"troubleshooting.md","pattern":"Generic API/secret keys","snippet":"**Cause:** `WALLET_PRIVATE_KEY` is empty. `provision()` writes it to `.env` at runtime, but `process","category":"env_access","line_end":104,"severity":"high","line_start":104},{"id":"env_access:troubleshooting.md:114:generic-api-secret-keys","file":"troubleshooting.md","pattern":"Generic API/secret keys","snippet":"dotenv.config({ override: true }) // reload to pick up WALLET_PRIVATE_KEY","category":"env_access","line_end":114,"severity":"high","line_start":114},{"id":"env_access:troubleshooting.md:125:generic-api-secret-keys","file":"troubleshooting.md","pattern":"Generic API/secret keys","snippet":"**Cause:** You are using the **agent** API key (`OPENSERV_API_KEY`) instead of the **user** API key.","category":"env_access","line_end":125,"severity":"high","line_start":125},{"id":"env_access:troubleshooting.md:127:generic-api-secret-keys","file":"troubleshooting.md","pattern":"Generic API/secret keys","snippet":"- **`OPENSERV_API_KEY`** — The agent's API key, set by `provision()`. Used internally by the agent t","category":"env_access","line_end":127,"severity":"high","line_start":127},{"id":"env_access:troubleshooting.md:128:generic-api-secret-keys","file":"troubleshooting.md","pattern":"Generic API/secret keys","snippet":"- **`OPENSERV_USER_API_KEY`** — Your user/account API key. Required for `PlatformClient` calls like ","category":"env_access","line_end":128,"severity":"high","line_start":128},{"id":"env_access:troubleshooting.md:135:generic-api-secret-keys","file":"troubleshooting.md","pattern":"Generic API/secret keys","snippet":"await client.authenticate(process.env.WALLET_PRIVATE_KEY)","category":"env_access","line_end":135,"severity":"high","line_start":135},{"id":"env_access:troubleshooting.md:139:generic-api-secret-keys","file":"troubleshooting.md","pattern":"Generic API/secret keys","snippet":"apiKey: process.env.OPENSERV_USER_API_KEY // NOT OPENSERV_API_KEY","category":"env_access","line_end":139,"severity":"high","line_start":139},{"id":"env_access:troubleshooting.md:143:generic-api-secret-keys","file":"troubleshooting.md","pattern":"Generic API/secret keys","snippet":"**Tip:** After `provision()` runs, the `WALLET_PRIVATE_KEY` is stored in `.env`. Use `dotenv.config(","category":"env_access","line_end":143,"severity":"high","line_start":143},{"id":"sensitive:troubleshooting.md:40:environment-file-access","file":"troubleshooting.md","pattern":"Environment file access","snippet":"Or set a different port in `.env`: `PORT=7379`","category":"sensitive","line_end":40,"severity":"high","line_start":40},{"id":"sensitive:troubleshooting.md:51:environment-file-access","file":"troubleshooting.md","pattern":"Environment file access","snippet":"// Save authToken to .env as OPENSERV_AUTH_TOKEN","category":"sensitive","line_end":51,"severity":"high","line_start":51},{"id":"sensitive:troubleshooting.md:104:environment-file-access","file":"troubleshooting.md","pattern":"Environment file access","snippet":"**Cause:** `WALLET_PRIVATE_KEY` is empty. `provision()` writes it to `.env` at runtime, but `process","category":"sensitive","line_end":104,"severity":"high","line_start":104},{"id":"sensitive:troubleshooting.md:117:environment-file-access","file":"troubleshooting.md","pattern":"Environment file access","snippet":"Do **not** use `import 'dotenv/config'` — it only loads `.env` once at import time and cannot be rel","category":"sensitive","line_end":117,"severity":"high","line_start":117},{"id":"sensitive:troubleshooting.md:135:environment-file-access","file":"troubleshooting.md","pattern":"Environment file access","snippet":"await client.authenticate(process.env.WALLET_PRIVATE_KEY)","category":"sensitive","line_end":135,"severity":"high","line_start":135},{"id":"sensitive:troubleshooting.md:139:environment-file-access","file":"troubleshooting.md","pattern":"Environment file access","snippet":"apiKey: process.env.OPENSERV_USER_API_KEY // NOT OPENSERV_API_KEY","category":"sensitive","line_end":139,"severity":"high","line_start":139},{"id":"sensitive:troubleshooting.md:143:environment-file-access","file":"troubleshooting.md","pattern":"Environment file access","snippet":"**Tip:** After `provision()` runs, the `WALLET_PRIVATE_KEY` is stored in `.env`. Use `dotenv.config(","category":"sensitive","line_end":143,"severity":"high","line_start":143}],"finding_verdicts":[{"id":"external_commands:examples/basic-agent.ts:27:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:examples/basic-agent.ts:28:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:examples/basic-agent.ts:54:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"network:examples/basic-agent.ts:54:hardcoded-url","reason":"Hardcoded URL is a documentation/example endpoint (OpenServ API, Base RPC, block explorer) shown for reference; not an unexpected exfiltration destination for a documentation skill.","verdict":"false_positive","confidence":0.92},{"id":"env_access:examples/basic-agent.ts:9:dotenv-library","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:examples/capability-example.ts:39:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:examples/capability-example.ts:43:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:examples/capability-with-agent-methods.ts:34:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:examples/capability-with-agent-methods.ts:39:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:examples/capability-with-agent-methods.ts:46:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:examples/capability-with-agent-methods.ts:65:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"env_access:examples/env.example:3:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:examples/env.example:4:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:examples/env.example:7:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:examples/env.example:10:generic-api-secret-keys","reason":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.","verdict":"confirmed","severity":"low","confidence":0.4},{"id":"env_access:examples/env.example:11:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:examples/error-handling.ts:51:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:examples/file-operations.ts:22:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:examples/file-operations.ts:43:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:examples/file-operations.ts:61:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"blocker:examples/file-operations.ts:20:system-reconnaissance","reason":"Normal OpenServ SDK usage (listing workspace files/agents, reading workspace/task/agent IDs) or descriptive prose. This is expected agent-platform API access, not host system reconnaissance.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:examples/haiku-poet-agent.ts:53:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:examples/haiku-poet-agent.ts:54:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"env_access:examples/haiku-poet-agent.ts:9:dotenv-library","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"blocker:examples/haiku-poet-agent.ts:4:system-reconnaissance","reason":"Normal OpenServ SDK usage (listing workspace files/agents, reading workspace/task/agent IDs) or descriptive prose. This is expected agent-platform API access, not host system reconnaissance.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:examples/multiple-capabilities.ts:41:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:examples/task-management.ts:44:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:examples/task-management.ts:97:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"blocker:examples/task-management.ts:84:system-reconnaissance","reason":"Normal OpenServ SDK usage (listing workspace files/agents, reading workspace/task/agent IDs) or descriptive prose. This is expected agent-platform API access, not host system reconnaissance.","verdict":"false_positive","confidence":0.9},{"id":"blocker:examples/task-management.ts:89:system-reconnaissance","reason":"Normal OpenServ SDK usage (listing workspace files/agents, reading workspace/task/agent IDs) or descriptive prose. This is expected agent-platform API access, not host system reconnaissance.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:reference.md:121:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:reference.md:127:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:reference.md:134:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:reference.md:278:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"network:reference.md:265:hardcoded-url","reason":"Hardcoded URL is a documentation/example endpoint (OpenServ API, Base RPC, block explorer) shown for reference; not an unexpected exfiltration destination for a documentation skill.","verdict":"false_positive","confidence":0.92},{"id":"network:reference.md:310:hardcoded-url","reason":"Hardcoded URL is a documentation/example endpoint (OpenServ API, Base RPC, block explorer) shown for reference; not an unexpected exfiltration destination for a documentation skill.","verdict":"false_positive","confidence":0.92},{"id":"network:reference.md:315:hardcoded-url","reason":"Hardcoded URL is a documentation/example endpoint (OpenServ API, Base RPC, block explorer) shown for reference; not an unexpected exfiltration destination for a documentation skill.","verdict":"false_positive","confidence":0.92},{"id":"network:reference.md:317:hardcoded-url","reason":"Hardcoded URL is a documentation/example endpoint (OpenServ API, Base RPC, block explorer) shown for reference; not an unexpected exfiltration destination for a documentation skill.","verdict":"false_positive","confidence":0.92},{"id":"network:reference.md:344:hardcoded-url","reason":"Hardcoded URL is a documentation/example endpoint (OpenServ API, Base RPC, block explorer) shown for reference; not an unexpected exfiltration destination for a documentation skill.","verdict":"false_positive","confidence":0.92},{"id":"env_access:reference.md:302:environment-variable-access-dot-notation","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:reference.md:306:environment-variable-access-dot-notation","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:reference.md:302:environment-variable-object","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:reference.md:306:environment-variable-object","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:reference.md:30:dotenv-library","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:reference.md:289:dotenv-library","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:reference.md:292:dotenv-library","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:reference.md:293:dotenv-library","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:reference.md:298:dotenv-library","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:reference.md:276:generic-api-secret-keys","reason":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.","verdict":"confirmed","severity":"low","confidence":0.4},{"id":"env_access:reference.md:289:generic-api-secret-keys","reason":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.","verdict":"confirmed","severity":"low","confidence":0.4},{"id":"env_access:reference.md:297:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:reference.md:302:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:reference.md:306:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:reference.md:331:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:reference.md:335:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:reference.md:336:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:reference.md:338:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:reference.md:340:generic-api-secret-keys","reason":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.","verdict":"confirmed","severity":"low","confidence":0.4},{"id":"sensitive:reference.md:289:environment-file-access","reason":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.","verdict":"confirmed","severity":"low","confidence":0.4},{"id":"sensitive:reference.md:297:environment-file-access","reason":"Documentation reference to a `.env` file or env-var name (setup/config guidance). No secret value is present and no unexpected file read of sensitive host paths occurs.","verdict":"false_positive","confidence":0.88},{"id":"sensitive:reference.md:302:environment-file-access","reason":"Documentation reference to a `.env` file or env-var name (setup/config guidance). No secret value is present and no unexpected file read of sensitive host paths occurs.","verdict":"false_positive","confidence":0.88},{"id":"sensitive:reference.md:306:environment-file-access","reason":"Documentation reference to a `.env` file or env-var name (setup/config guidance). No secret value is present and no unexpected file read of sensitive host paths occurs.","verdict":"false_positive","confidence":0.88},{"id":"sensitive:reference.md:306:crypto-seed-private-key-mention","reason":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.","verdict":"confirmed","severity":"low","confidence":0.4},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:135:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:142:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:148:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:162:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:180:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:182:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:185:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:191:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:205:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:208:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:211:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:213:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:224:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:228:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:232:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:238:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:240:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:253:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:255:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:261:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:263:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:264:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:273:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:279:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:286:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:288:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:292:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:294:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:295:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:299:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:303:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:305:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:313:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:315:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:317:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:320:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:323:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:329:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:331:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:333:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:337:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:339:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:343:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:347:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:351:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:353:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:370:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:378:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:380:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:384:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:385:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:387:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:421:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:422:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:423:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:429:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:433:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:441:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:442:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:443:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:451:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:457:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:461:ruby-shell-backtick-execution","reason":"Matches a JavaScript/TypeScript template literal (backtick string) or a Markdown code fence, not Ruby/shell backtick command execution. These are string interpolation / doc formatting with no process execution.","verdict":"false_positive","confidence":0.95},{"id":"network:SKILL.md:358:hardcoded-url","reason":"Hardcoded URL is a documentation/example endpoint (OpenServ API, Base RPC, block explorer) shown for reference; not an unexpected exfiltration destination for a documentation skill.","verdict":"false_positive","confidence":0.92},{"id":"network:SKILL.md:423:hardcoded-url","reason":"Hardcoded URL is a documentation/example endpoint (OpenServ API, Base RPC, block explorer) shown for reference; not an unexpected exfiltration destination for a documentation skill.","verdict":"false_positive","confidence":0.92},{"id":"env_access:SKILL.md:301:environment-variable-access-dot-notation","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:412:environment-variable-access-dot-notation","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:416:environment-variable-access-dot-notation","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:301:environment-variable-object","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:412:environment-variable-object","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:416:environment-variable-object","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:70:dotenv-library","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:384:dotenv-library","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:385:dotenv-library","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:388:dotenv-library","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:389:dotenv-library","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:407:dotenv-library","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:78:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:82:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:83:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:86:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:89:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:90:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:294:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:295:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:301:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:337:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:344:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:384:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:406:generic-api-secret-keys","reason":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.","verdict":"confirmed","severity":"low","confidence":0.4},{"id":"env_access:SKILL.md:412:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:SKILL.md:416:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"sensitive:SKILL.md:60:environment-file-access","reason":"Documentation reference to a `.env` file or env-var name (setup/config guidance). No secret value is present and no unexpected file read of sensitive host paths occurs.","verdict":"false_positive","confidence":0.88},{"id":"sensitive:SKILL.md:76:environment-file-access","reason":"Documentation reference to a `.env` file or env-var name (setup/config guidance). No secret value is present and no unexpected file read of sensitive host paths occurs.","verdict":"false_positive","confidence":0.88},{"id":"sensitive:SKILL.md:301:environment-file-access","reason":"Documentation reference to a `.env` file or env-var name (setup/config guidance). No secret value is present and no unexpected file read of sensitive host paths occurs.","verdict":"false_positive","confidence":0.88},{"id":"sensitive:SKILL.md:337:environment-file-access","reason":"Documentation reference to a `.env` file or env-var name (setup/config guidance). No secret value is present and no unexpected file read of sensitive host paths occurs.","verdict":"false_positive","confidence":0.88},{"id":"sensitive:SKILL.md:344:environment-file-access","reason":"Documentation reference to a `.env` file or env-var name (setup/config guidance). No secret value is present and no unexpected file read of sensitive host paths occurs.","verdict":"false_positive","confidence":0.88},{"id":"sensitive:SKILL.md:384:environment-file-access","reason":"Documentation reference to a `.env` file or env-var name (setup/config guidance). No secret value is present and no unexpected file read of sensitive host paths occurs.","verdict":"false_positive","confidence":0.88},{"id":"sensitive:SKILL.md:406:environment-file-access","reason":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.","verdict":"confirmed","severity":"low","confidence":0.4},{"id":"sensitive:SKILL.md:412:environment-file-access","reason":"Documentation reference to a `.env` file or env-var name (setup/config guidance). No secret value is present and no unexpected file read of sensitive host paths occurs.","verdict":"false_positive","confidence":0.88},{"id":"sensitive:SKILL.md:416:environment-file-access","reason":"Documentation reference to a `.env` file or env-var name (setup/config guidance). No secret value is present and no unexpected file read of sensitive host paths occurs.","verdict":"false_positive","confidence":0.88},{"id":"sensitive:SKILL.md:416:crypto-seed-private-key-mention","reason":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.","verdict":"confirmed","severity":"low","confidence":0.4},{"id":"blocker:SKILL.md:12:system-reconnaissance","reason":"Normal OpenServ SDK usage (listing workspace files/agents, reading workspace/task/agent IDs) or descriptive prose. This is expected agent-platform API access, not host system reconnaissance.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:245:system-reconnaissance","reason":"Normal OpenServ SDK usage (listing workspace files/agents, reading workspace/task/agent IDs) or descriptive prose. This is expected agent-platform API access, not host system reconnaissance.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:247:system-reconnaissance","reason":"Normal OpenServ SDK usage (listing workspace files/agents, reading workspace/task/agent IDs) or descriptive prose. This is expected agent-platform API access, not host system reconnaissance.","verdict":"false_positive","confidence":0.9},{"id":"blocker:SKILL.md:250:system-reconnaissance","reason":"Normal OpenServ SDK usage (listing workspace files/agents, reading workspace/task/agent IDs) or descriptive prose. This is expected agent-platform API access, not host system reconnaissance.","verdict":"false_positive","confidence":0.9},{"id":"scripts:troubleshooting.md:175:dynamic-import-expression","reason":"Documented ESM/CommonJS interop pattern (`await import('@openserv-labs/sdk')`) with a static, hardcoded package specifier. Not attacker-controlled dynamic loading.","verdict":"false_positive","confidence":0.9},{"id":"scripts:troubleshooting.md:179:dynamic-import-expression","reason":"Documented ESM/CommonJS interop pattern (`await import('@openserv-labs/sdk')`) with a static, hardcoded package specifier. Not attacker-controlled dynamic loading.","verdict":"false_positive","confidence":0.9},{"id":"scripts:troubleshooting.md:180:dynamic-import-expression","reason":"Documented ESM/CommonJS interop pattern (`await import('@openserv-labs/sdk')`) with a static, hardcoded package specifier. Not attacker-controlled dynamic loading.","verdict":"false_positive","confidence":0.9},{"id":"scripts:troubleshooting.md:186:dynamic-require-with-variable","reason":"Documented ESM/CommonJS interop pattern (`await import('@openserv-labs/sdk')`) with a static, hardcoded package specifier. Not attacker-controlled dynamic loading.","verdict":"false_positive","confidence":0.9},{"id":"external_commands:troubleshooting.md:37:xargs-command-can-execute-arbitrary-commands","reason":"The xargs usage is a documented troubleshooting one-liner (`lsof -ti:PORT | xargs kill -9`) to free a stuck local dev port. Arguments are fixed, not attacker-controlled; no injection vector.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:135:environment-variable-access-dot-notation","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:139:environment-variable-access-dot-notation","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:104:environment-variable-object","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:135:environment-variable-object","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:139:environment-variable-object","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:106:dotenv-library","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:109:dotenv-library","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:110:dotenv-library","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:114:dotenv-library","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:117:dotenv-library","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:143:dotenv-library","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:9:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:80:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:84:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:104:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:114:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:125:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:127:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:128:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:135:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:139:generic-api-secret-keys","reason":"References an environment variable name or the dotenv library in documentation / a .env.example placeholder. No real secret value is embedded; this is standard configuration guidance.","verdict":"false_positive","confidence":0.9},{"id":"env_access:troubleshooting.md:143:generic-api-secret-keys","reason":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.","verdict":"confirmed","severity":"low","confidence":0.4},{"id":"sensitive:troubleshooting.md:40:environment-file-access","reason":"Documentation reference to a `.env` file or env-var name (setup/config guidance). No secret value is present and no unexpected file read of sensitive host paths occurs.","verdict":"false_positive","confidence":0.88},{"id":"sensitive:troubleshooting.md:51:environment-file-access","reason":"Documentation reference to a `.env` file or env-var name (setup/config guidance). No secret value is present and no unexpected file read of sensitive host paths occurs.","verdict":"false_positive","confidence":0.88},{"id":"sensitive:troubleshooting.md:104:environment-file-access","reason":"Documentation reference to a `.env` file or env-var name (setup/config guidance). No secret value is present and no unexpected file read of sensitive host paths occurs.","verdict":"false_positive","confidence":0.88},{"id":"sensitive:troubleshooting.md:117:environment-file-access","reason":"Documentation reference to a `.env` file or env-var name (setup/config guidance). No secret value is present and no unexpected file read of sensitive host paths occurs.","verdict":"false_positive","confidence":0.88},{"id":"sensitive:troubleshooting.md:135:environment-file-access","reason":"Documentation reference to a `.env` file or env-var name (setup/config guidance). No secret value is present and no unexpected file read of sensitive host paths occurs.","verdict":"false_positive","confidence":0.88},{"id":"sensitive:troubleshooting.md:139:environment-file-access","reason":"Documentation reference to a `.env` file or env-var name (setup/config guidance). No secret value is present and no unexpected file read of sensitive host paths occurs.","verdict":"false_positive","confidence":0.88},{"id":"sensitive:troubleshooting.md:143:environment-file-access","reason":"Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.","verdict":"confirmed","severity":"low","confidence":0.4}],"semantic_findings":[{"title":"Documented runtime persistence of a crypto wallet private key to .env","severity":"low","locations":[{"file":"reference.md","line_end":289,"line_start":289},{"file":"reference.md","line_end":306,"line_start":306},{"file":"SKILL.md","line_end":416,"line_start":406}],"confidence":0.55,"description":"The reference and SKILL docs describe provision() writing WALLET_PRIVATE_KEY into the local .env file at runtime, then reloading it via dotenv.config({ override: true }), so the agent can sign on-chain ERC-8004 registration and x402/USDC payment transactions. This is transparent, intended SDK behavior documented for the developer — not covert exfiltration — but reviewers and users should understand that a spendable private key is stored in plaintext on disk and used to move funds on Base mainnet.","confidence_reasoning":"The behavior is explicitly documented as an intended SDK feature for payments, so it is not malicious; the low-but-nonzero confidence reflects the genuine sensitivity of persisting a spendable private key to a plaintext .env rather than any sign of hidden intent."}],"subject_marketplace_commit_sha":"3f6e026a3363e0954ede7bef0cfe88d4475de137","subject_content_hash":"11889e6dcecacff187f6490c6638695bb546e2a3254df44bb11e0a05e29c36e1","subject_tree_hash":"71898b48419b93968d81623ce81e91d4e208bb14bb6e32645f8efab5e16615ae","subject_plugin_path":"skills/internet-court/openserv-agent-sdk","audit_payload_hash":"fef700dd94c3d7b53d018fba71477423","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"3f6e026a3363e0954ede7bef0cfe88d4475de137","contentHash":"11889e6dcecacff187f6490c6638695bb546e2a3254df44bb11e0a05e29c36e1","treeHash":"71898b48419b93968d81623ce81e91d4e208bb14bb6e32645f8efab5e16615ae","pluginPath":"skills/internet-court/openserv-agent-sdk","auditPayloadHash":"fef700dd94c3d7b53d018fba71477423"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"unavailable","url":null,"status":null},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":6,"capabilityReviewCount":6,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"unavailable","verificationState":"not_verified"},"isLatest":true}}