{"data":{"skill":{"slug":"internet-court-starknet-js","name":"starknet-js","icon":"📦","repo":"https://github.com/internet-court/internet-court-skill/tree/main/vendored/starknet/starknet-js","status":"approved","author":"internet-court","authorVersion":"1.0.0","skillstoreRevision":1},"audit":{"id":"74178b39-d9f2-4d9a-9d43-243aa7605ca3","skill_id":"f493621c-b0dc-4061-8864-baaa4622fcf9","version":2,"content_hash":"v3:3f6e026a3363e0954ede7bef0cfe88d4475de137:f180f2766f26444b72c5fcd4bb9bf9259658278a71e89e9a7a2d5af70caa317c:8c2af68bdb0779a2f369d1c05c1dfd8a94eb463650e926f416895f7bb9b79fb7:736b696c6c732f696e7465726e65742d636f7572742f737461726b6e65742d6a73:ed20ac50431ac040f11277eeb4bc75a3","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 99 static findings are false positives: they identify Markdown fences, documentation links, public endpoint examples, normal signer handling, or non-sensitive configuration access. No prompt injection, secret exfiltration, command execution, or hidden network behavior was found. The documentation should add consistent user-confirmation guidance before state-changing transactions.","remediation":[{"issue":"State-changing examples lack a consistent confirmation step.","severity":"medium","suggestion":"Before every transfer, approval, deployment, paymaster, or outside-execution example, require users to review network, recipient, calldata, allowance, fee, and transaction intent before submission."},{"issue":"Examples use third-party RPC and paymaster endpoints.","severity":"low","suggestion":"Label endpoints as examples and direct users to configure trusted, environment-specific providers with chain ID checks and privacy review."},{"issue":"Private-key examples may encourage insecure local handling.","severity":"low","suggestion":"Add a prominent warning to use a secret manager or wallet signer and never place private keys in source code, logs, or shared environment files."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"scripts/account-example.ts","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":52,"line_start":50},{"file":"SKILL.md","line_end":56,"line_start":52},{"file":"SKILL.md","line_end":62,"line_start":56},{"file":"SKILL.md","line_end":66,"line_start":62},{"file":"SKILL.md","line_end":70,"line_start":66},{"file":"SKILL.md","line_end":80,"line_start":70},{"file":"SKILL.md","line_end":87,"line_start":80},{"file":"SKILL.md","line_end":90,"line_start":87},{"file":"SKILL.md","line_end":91,"line_start":90},{"file":"SKILL.md","line_end":94,"line_start":91},{"file":"SKILL.md","line_end":102,"line_start":94},{"file":"SKILL.md","line_end":109,"line_start":102},{"file":"SKILL.md","line_end":112,"line_start":109},{"file":"SKILL.md","line_end":123,"line_start":112},{"file":"SKILL.md","line_end":128,"line_start":123},{"file":"SKILL.md","line_end":140,"line_start":128},{"file":"SKILL.md","line_end":146,"line_start":140},{"file":"SKILL.md","line_end":153,"line_start":146},{"file":"SKILL.md","line_end":159,"line_start":153},{"file":"SKILL.md","line_end":164,"line_start":159},{"file":"SKILL.md","line_end":168,"line_start":164},{"file":"SKILL.md","line_end":172,"line_start":168},{"file":"SKILL.md","line_end":176,"line_start":172},{"file":"SKILL.md","line_end":179,"line_start":176},{"file":"SKILL.md","line_end":183,"line_start":179},{"file":"SKILL.md","line_end":186,"line_start":183},{"file":"SKILL.md","line_end":190,"line_start":186},{"file":"SKILL.md","line_end":207,"line_start":190},{"file":"SKILL.md","line_end":209,"line_start":207},{"file":"SKILL.md","line_end":210,"line_start":209},{"file":"SKILL.md","line_end":217,"line_start":210},{"file":"SKILL.md","line_end":221,"line_start":217},{"file":"SKILL.md","line_end":225,"line_start":221},{"file":"SKILL.md","line_end":231,"line_start":225},{"file":"SKILL.md","line_end":245,"line_start":231},{"file":"SKILL.md","line_end":249,"line_start":245},{"file":"SKILL.md","line_end":255,"line_start":249},{"file":"SKILL.md","line_end":258,"line_start":255},{"file":"SKILL.md","line_end":266,"line_start":258},{"file":"SKILL.md","line_end":269,"line_start":266},{"file":"SKILL.md","line_end":272,"line_start":269},{"file":"SKILL.md","line_end":276,"line_start":272},{"file":"SKILL.md","line_end":289,"line_start":276},{"file":"SKILL.md","line_end":295,"line_start":289},{"file":"SKILL.md","line_end":311,"line_start":295},{"file":"SKILL.md","line_end":317,"line_start":311},{"file":"SKILL.md","line_end":322,"line_start":317},{"file":"SKILL.md","line_end":325,"line_start":322},{"file":"SKILL.md","line_end":327,"line_start":325}]},{"factor":"env_access","evidence":[{"file":"scripts/account-example.ts","line_end":10,"line_start":10},{"file":"scripts/account-example.ts","line_end":10,"line_start":10},{"file":"scripts/account-example.ts","line_end":4,"line_start":4},{"file":"scripts/account-example.ts","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":495,"line_start":495}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":59,"line_start":59},{"file":"SKILL.md","line_end":85,"line_start":85},{"file":"SKILL.md","line_end":90,"line_start":90},{"file":"SKILL.md","line_end":91,"line_start":91},{"file":"SKILL.md","line_end":301,"line_start":301},{"file":"SKILL.md","line_end":320,"line_start":320}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":38,"line_start":38}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Transaction examples need stronger user-confirmation guidance","locations":[{"file":"SKILL.md","line_end":207,"line_start":181},{"file":"SKILL.md","line_end":470,"line_start":455}],"confidence":0.78,"description":"The guide shows approval, transfer, multicall, delegated execution, and paymaster submission flows without a consistent requirement to present final calldata, recipient, token allowance, and fee to the user before submission.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"These examples invoke state-changing account methods, including approvals and delegated execution. The material is educational, but missing confirmation guidance can contribute to unintended high-impact transactions."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":9,"total_lines":685,"audit_model":"claude","audited_at":"2026-07-21T04:37:03.624+00:00","created_at":"2026-07-21T04:43:49.78321+00:00","static_findings":[{"id":"blocker:references/fee-strategy.md:27:system-reconnaissance","file":"references/fee-strategy.md","pattern":"System reconnaissance","snippet":"- Capture estimate vs final paid fee deltas for monitoring.","category":"blocker","line_end":27,"severity":"low","line_start":27},{"id":"blocker:references/provider-hardening.md:7:system-reconnaissance","file":"references/provider-hardening.md","pattern":"System reconnaissance","snippet":"- Use explicit RPC URL per environment (`mainnet`, `sepolia`) and avoid implicit defaults.","category":"blocker","line_end":7,"severity":"low","line_start":7},{"id":"blocker:references/provider-hardening.md:27:system-reconnaissance","file":"references/provider-hardening.md","pattern":"System reconnaissance","snippet":"- Keep block-tag use explicit (`latest`, pinned block) to avoid silent semantic drift.","category":"blocker","line_end":27,"severity":"low","line_start":27},{"id":"blocker:references/README.md:8:system-reconnaissance","file":"references/README.md","pattern":"System reconnaissance","snippet":"- `fee-strategy.md` - practical fee policy for user-paid and sponsored execution paths.","category":"blocker","line_end":8,"severity":"low","line_start":8},{"id":"external_commands:scripts/account-example.ts:12:ruby-shell-backtick-execution","file":"scripts/account-example.ts","pattern":"Ruby/shell backtick execution","snippet":"throw new Error(`Missing ${name}`);","category":"external_commands","line_end":12,"severity":"medium","line_start":12},{"id":"env_access:scripts/account-example.ts:10:environment-variable-access-bracket-notation","file":"scripts/account-example.ts","pattern":"Environment variable access (bracket notation)","snippet":"const value = process.env[name]?.trim();","category":"env_access","line_end":10,"severity":"low","line_start":10},{"id":"env_access:scripts/account-example.ts:10:environment-variable-object","file":"scripts/account-example.ts","pattern":"Environment variable object","snippet":"const value = process.env[name]?.trim();","category":"env_access","line_end":10,"severity":"low","line_start":10},{"id":"env_access:scripts/account-example.ts:4:generic-api-secret-keys","file":"scripts/account-example.ts","pattern":"Generic API/secret keys","snippet":"*   STARKNET_RPC_URL=... STARKNET_ACCOUNT_ADDRESS=0x... STARKNET_PRIVATE_KEY=0x... tsx scripts/accou","category":"env_access","line_end":4,"severity":"high","line_start":4},{"id":"env_access:scripts/account-example.ts:20:generic-api-secret-keys","file":"scripts/account-example.ts","pattern":"Generic API/secret keys","snippet":"const privateKey = requireEnv(\"STARKNET_PRIVATE_KEY\");","category":"env_access","line_end":20,"severity":"high","line_start":20},{"id":"sensitive:scripts/account-example.ts:10:environment-file-access","file":"scripts/account-example.ts","pattern":"Environment file access","snippet":"const value = process.env[name]?.trim();","category":"sensitive","line_end":10,"severity":"high","line_start":10},{"id":"sensitive:scripts/account-example.ts:20:crypto-seed-private-key-mention","file":"scripts/account-example.ts","pattern":"Crypto seed/private key mention","snippet":"const privateKey = requireEnv(\"STARKNET_PRIVATE_KEY\");","category":"sensitive","line_end":20,"severity":"high","line_start":20},{"id":"sensitive:scripts/account-example.ts:26:crypto-seed-private-key-mention","file":"scripts/account-example.ts","pattern":"Crypto seed/private key mention","snippet":"signer: privateKey,","category":"sensitive","line_end":26,"severity":"high","line_start":26},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":52,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":56,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":62,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":66,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":70,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":80,"severity":"medium","line_start":70},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":87,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":90,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Mainnet: `https://rpc.starknet.lava.build`","category":"external_commands","line_end":91,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Sepolia: `https://rpc.starknet-testnet.lava.build`","category":"external_commands","line_end":94,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":102,"severity":"medium","line_start":94},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":109,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":112,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"// IMPORTANT: `stark.randomAddress()` returns an address-like random felt and is NOT a private key.","category":"external_commands","line_end":123,"severity":"medium","line_start":112},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":128,"severity":"medium","line_start":123},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":140,"severity":"medium","line_start":128},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":146,"severity":"medium","line_start":140},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":153,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":159,"severity":"medium","line_start":153},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":164,"severity":"medium","line_start":159},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":168,"severity":"medium","line_start":164},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":172,"severity":"medium","line_start":168},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":176,"severity":"medium","line_start":172},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":179,"severity":"medium","line_start":176},{"id":"external_commands:SKILL.md:179:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":183,"severity":"medium","line_start":179},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":186,"severity":"medium","line_start":183},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":190,"severity":"medium","line_start":186},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":207,"severity":"medium","line_start":190},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":209,"severity":"medium","line_start":207},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Using `populate()` for type-safety:","category":"external_commands","line_end":210,"severity":"medium","line_start":209},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":217,"severity":"medium","line_start":210},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":221,"severity":"medium","line_start":217},{"id":"external_commands:SKILL.md:221:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":225,"severity":"medium","line_start":221},{"id":"external_commands:SKILL.md:225:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":231,"severity":"medium","line_start":225},{"id":"external_commands:SKILL.md:231:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":245,"severity":"medium","line_start":231},{"id":"external_commands:SKILL.md:245:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":249,"severity":"medium","line_start":245},{"id":"external_commands:SKILL.md:249:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":255,"severity":"medium","line_start":249},{"id":"external_commands:SKILL.md:255:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":258,"severity":"medium","line_start":255},{"id":"external_commands:SKILL.md:258:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":266,"severity":"medium","line_start":258},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":269,"severity":"medium","line_start":266},{"id":"external_commands:SKILL.md:269:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":272,"severity":"medium","line_start":269},{"id":"external_commands:SKILL.md:272:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":276,"severity":"medium","line_start":272},{"id":"external_commands:SKILL.md:276:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":289,"severity":"medium","line_start":276},{"id":"external_commands:SKILL.md:289:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":295,"severity":"medium","line_start":289},{"id":"external_commands:SKILL.md:295:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":311,"severity":"medium","line_start":295},{"id":"external_commands:SKILL.md:311:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":317,"severity":"medium","line_start":311},{"id":"external_commands:SKILL.md:317:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":322,"severity":"medium","line_start":317},{"id":"external_commands:SKILL.md:322:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":325,"severity":"medium","line_start":322},{"id":"external_commands:SKILL.md:325:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":327,"severity":"medium","line_start":325},{"id":"external_commands:SKILL.md:327:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":330,"severity":"medium","line_start":327},{"id":"external_commands:SKILL.md:330:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":335,"severity":"medium","line_start":330},{"id":"external_commands:SKILL.md:335:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":339,"severity":"medium","line_start":335},{"id":"external_commands:SKILL.md:339:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":358,"severity":"medium","line_start":339},{"id":"external_commands:SKILL.md:358:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":362,"severity":"medium","line_start":358},{"id":"external_commands:SKILL.md:362:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":384,"severity":"medium","line_start":362},{"id":"external_commands:SKILL.md:384:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":386,"severity":"medium","line_start":384},{"id":"external_commands:SKILL.md:386:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Important:** Always use `BigInt` (e.g., `1000n`) for token amounts and balances. Never use `Number","category":"external_commands","line_end":386,"severity":"medium","line_start":386},{"id":"external_commands:SKILL.md:390:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":404,"severity":"medium","line_start":390},{"id":"external_commands:SKILL.md:404:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":408,"severity":"medium","line_start":404},{"id":"external_commands:SKILL.md:408:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":422,"severity":"medium","line_start":408},{"id":"external_commands:SKILL.md:422:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":426,"severity":"medium","line_start":422},{"id":"external_commands:SKILL.md:426:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":453,"severity":"medium","line_start":426},{"id":"external_commands:SKILL.md:453:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":459,"severity":"medium","line_start":453},{"id":"external_commands:SKILL.md:459:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":470,"severity":"medium","line_start":459},{"id":"external_commands:SKILL.md:470:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":474,"severity":"medium","line_start":470},{"id":"external_commands:SKILL.md:474:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":486,"severity":"medium","line_start":474},{"id":"external_commands:SKILL.md:486:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":490,"severity":"medium","line_start":486},{"id":"external_commands:SKILL.md:490:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":499,"severity":"medium","line_start":490},{"id":"network:SKILL.md:59:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"const provider = await RpcProvider.create({ nodeUrl: 'https://rpc.starknet.lava.build' });","category":"network","line_end":59,"severity":"low","line_start":59},{"id":"network:SKILL.md:85:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"nodeUrl: 'https://rpc.starknet.lava.build'","category":"network","line_end":85,"severity":"low","line_start":85},{"id":"network:SKILL.md:90:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Mainnet: `https://rpc.starknet.lava.build`","category":"network","line_end":90,"severity":"low","line_start":90},{"id":"network:SKILL.md:91:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Sepolia: `https://rpc.starknet-testnet.lava.build`","category":"network","line_end":91,"severity":"low","line_start":91},{"id":"network:SKILL.md:301:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"{ nodeUrl: 'https://rpc.starknet.lava.build' },","category":"network","line_end":301,"severity":"low","line_start":301},{"id":"network:SKILL.md:320:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"const paymaster = new PaymasterRpc({ nodeUrl: 'https://sepolia.paymaster.avnu.fi' });","category":"network","line_end":320,"severity":"low","line_start":320},{"id":"filesystem:SKILL.md:38:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"Related modules: [skills catalog](../README.md).","category":"filesystem","line_end":38,"severity":"high","line_start":38},{"id":"env_access:SKILL.md:495:configuration-library","file":"SKILL.md","pattern":"Configuration library","snippet":"config.get('transactionVersion');","category":"env_access","line_end":495,"severity":"low","line_start":495},{"id":"sensitive:SKILL.md:112:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"// IMPORTANT: `stark.randomAddress()` returns an address-like random felt and is NOT a private key.","category":"sensitive","line_end":112,"severity":"high","line_start":112},{"id":"sensitive:SKILL.md:113:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"// Use a real stark curve private key generator.","category":"sensitive","line_end":113,"severity":"high","line_start":113},{"id":"sensitive:SKILL.md:114:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"const privateKey = '0x' + encode.buf2hex(ec.starkCurve.utils.randomPrivateKey());","category":"sensitive","line_end":114,"severity":"high","line_start":114},{"id":"sensitive:SKILL.md:115:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"const publicKey = ec.starkCurve.getStarkKey(privateKey);","category":"sensitive","line_end":115,"severity":"high","line_start":115},{"id":"sensitive:SKILL.md:133:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"const account = new Account({ provider, address, signer: privateKey, cairoVersion: '1' });","category":"sensitive","line_end":133,"severity":"high","line_start":133},{"id":"sensitive:SKILL.md:150:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"signer: privateKey,","category":"sensitive","line_end":150,"severity":"high","line_start":150},{"id":"sensitive:SKILL.md:321:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"const account = new Account({ provider, address, signer: privateKey, paymaster });","category":"sensitive","line_end":321,"severity":"high","line_start":321},{"id":"sensitive:SKILL.md:412:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"const privateKey = '0x' + encode.buf2hex(ec.starkCurve.utils.randomPrivateKey());","category":"sensitive","line_end":412,"severity":"high","line_start":412},{"id":"sensitive:SKILL.md:413:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"const publicKey = ec.starkCurve.getStarkKey(privateKey);","category":"sensitive","line_end":413,"severity":"high","line_start":413},{"id":"sensitive:SKILL.md:431:crypto-seed-private-key-mention","file":"SKILL.md","pattern":"Crypto seed/private key mention","snippet":"salt: stark.randomAddress(), // random felt252 salt (not a private key)","category":"sensitive","line_end":431,"severity":"high","line_start":431},{"id":"blocker:SKILL.md:357:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"const isValid = ec.starkCurve.verify(signature, msgHash, publicKey);","category":"blocker","line_end":357,"severity":"low","line_start":357}],"finding_verdicts":[{"id":"blocker:references/fee-strategy.md:27:system-reconnaissance","reason":"This is ordinary documentation about fee monitoring, provider configuration, reference contents, or signature verification. It does not perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/provider-hardening.md:7:system-reconnaissance","reason":"This is ordinary documentation about fee monitoring, provider configuration, reference contents, or signature verification. It does not perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/provider-hardening.md:27:system-reconnaissance","reason":"This is ordinary documentation about fee monitoring, provider configuration, reference contents, or signature verification. It does not perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"blocker:references/README.md:8:system-reconnaissance","reason":"This is ordinary documentation about fee monitoring, provider configuration, reference contents, or signature verification. It does not perform system reconnaissance.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:scripts/account-example.ts:12:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"env_access:scripts/account-example.ts:10:environment-variable-access-bracket-notation","reason":"The example reads a named environment variable for local configuration and trims it. It does not write, transmit, or enumerate environment variables.","verdict":"false_positive","confidence":0.96},{"id":"env_access:scripts/account-example.ts:10:environment-variable-object","reason":"The example accesses a caller-specified environment variable to load local configuration. There is no secret disclosure or exfiltration behavior.","verdict":"false_positive","confidence":0.96},{"id":"env_access:scripts/account-example.ts:4:generic-api-secret-keys","reason":"The private-key references are documented local input for an account connectivity example. The script uses the signer locally and does not log or transmit the key.","verdict":"false_positive","confidence":0.95},{"id":"env_access:scripts/account-example.ts:20:generic-api-secret-keys","reason":"The private-key references are documented local input for an account connectivity example. The script uses the signer locally and does not log or transmit the key.","verdict":"false_positive","confidence":0.95},{"id":"sensitive:scripts/account-example.ts:10:environment-file-access","reason":"The code reads process.env and does not access an environment file. The pattern does not identify filesystem access or secret leakage.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/account-example.ts:20:crypto-seed-private-key-mention","reason":"The account example needs a private key as a local signer input. It neither embeds a real key nor exposes the provided value.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:scripts/account-example.ts:26:crypto-seed-private-key-mention","reason":"The account example needs a private key as a local signer input. It neither embeds a real key nor exposes the provided value.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:112:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:123:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:128:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:172:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:179:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:183:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:186:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:209:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:217:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:221:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:225:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:231:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:245:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:249:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:255:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:258:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:266:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:269:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:272:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:276:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:289:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:295:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:311:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:317:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:322:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:325:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:327:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:330:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:335:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:339:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:358:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:362:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:384:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:386:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:390:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:404:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:408:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:422:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:426:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:453:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:459:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:470:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:474:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:486:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:490:ruby-shell-backtick-execution","reason":"This is Markdown fence syntax or a template literal in documentation, not a shell execution API. No command is executed by the skill from this location.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:59:hardcoded-url","reason":"This is a documented, explicit Starknet RPC or paymaster endpoint in an SDK example. The reference does not perform hidden network activity or transmit secrets.","verdict":"false_positive","confidence":0.94},{"id":"network:SKILL.md:85:hardcoded-url","reason":"This is a documented, explicit Starknet RPC or paymaster endpoint in an SDK example. The reference does not perform hidden network activity or transmit secrets.","verdict":"false_positive","confidence":0.94},{"id":"network:SKILL.md:90:hardcoded-url","reason":"This is a documented, explicit Starknet RPC or paymaster endpoint in an SDK example. The reference does not perform hidden network activity or transmit secrets.","verdict":"false_positive","confidence":0.94},{"id":"network:SKILL.md:91:hardcoded-url","reason":"This is a documented, explicit Starknet RPC or paymaster endpoint in an SDK example. The reference does not perform hidden network activity or transmit secrets.","verdict":"false_positive","confidence":0.94},{"id":"network:SKILL.md:301:hardcoded-url","reason":"This is a documented, explicit Starknet RPC or paymaster endpoint in an SDK example. The reference does not perform hidden network activity or transmit secrets.","verdict":"false_positive","confidence":0.94},{"id":"network:SKILL.md:320:hardcoded-url","reason":"This is a documented, explicit Starknet RPC or paymaster endpoint in an SDK example. The reference does not perform hidden network activity or transmit secrets.","verdict":"false_positive","confidence":0.94},{"id":"filesystem:SKILL.md:38:path-traversal-sequence","reason":"The sequence appears only in a relative Markdown link to a skills catalog. It is not used for filesystem access or path resolution.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:495:configuration-library","reason":"This is a documented starknet.js configuration getter, not access to process environment variables or a configuration file.","verdict":"false_positive","confidence":0.98},{"id":"sensitive:SKILL.md:112:crypto-seed-private-key-mention","reason":"The documentation discusses generated or caller-provided signing keys for normal Starknet account workflows. It contains no real secret and no instruction to disclose one.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:SKILL.md:113:crypto-seed-private-key-mention","reason":"The documentation discusses generated or caller-provided signing keys for normal Starknet account workflows. It contains no real secret and no instruction to disclose one.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:SKILL.md:114:crypto-seed-private-key-mention","reason":"The documentation discusses generated or caller-provided signing keys for normal Starknet account workflows. It contains no real secret and no instruction to disclose one.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:SKILL.md:115:crypto-seed-private-key-mention","reason":"The documentation discusses generated or caller-provided signing keys for normal Starknet account workflows. It contains no real secret and no instruction to disclose one.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:SKILL.md:133:crypto-seed-private-key-mention","reason":"The documentation discusses generated or caller-provided signing keys for normal Starknet account workflows. It contains no real secret and no instruction to disclose one.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:SKILL.md:150:crypto-seed-private-key-mention","reason":"The documentation discusses generated or caller-provided signing keys for normal Starknet account workflows. It contains no real secret and no instruction to disclose one.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:SKILL.md:321:crypto-seed-private-key-mention","reason":"The documentation discusses generated or caller-provided signing keys for normal Starknet account workflows. It contains no real secret and no instruction to disclose one.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:SKILL.md:412:crypto-seed-private-key-mention","reason":"The documentation discusses generated or caller-provided signing keys for normal Starknet account workflows. It contains no real secret and no instruction to disclose one.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:SKILL.md:413:crypto-seed-private-key-mention","reason":"The documentation discusses generated or caller-provided signing keys for normal Starknet account workflows. It contains no real secret and no instruction to disclose one.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:SKILL.md:431:crypto-seed-private-key-mention","reason":"The documentation discusses generated or caller-provided signing keys for normal Starknet account workflows. It contains no real secret and no instruction to disclose one.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:357:system-reconnaissance","reason":"This is ordinary documentation about fee monitoring, provider configuration, reference contents, or signature verification. It does not perform system reconnaissance.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[{"title":"Transaction examples need stronger user-confirmation guidance","severity":"medium","locations":[{"file":"SKILL.md","line_end":207,"line_start":181},{"file":"SKILL.md","line_end":470,"line_start":455}],"confidence":0.78,"description":"The guide shows approval, transfer, multicall, delegated execution, and paymaster submission flows without a consistent requirement to present final calldata, recipient, token allowance, and fee to the user before submission.","confidence_reasoning":"These examples invoke state-changing account methods, including approvals and delegated execution. The material is educational, but missing confirmation guidance can contribute to unintended high-impact transactions."}],"subject_marketplace_commit_sha":"3f6e026a3363e0954ede7bef0cfe88d4475de137","subject_content_hash":"f180f2766f26444b72c5fcd4bb9bf9259658278a71e89e9a7a2d5af70caa317c","subject_tree_hash":"8c2af68bdb0779a2f369d1c05c1dfd8a94eb463650e926f416895f7bb9b79fb7","subject_plugin_path":"skills/internet-court/starknet-js","audit_payload_hash":"ed20ac50431ac040f11277eeb4bc75a3","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"3f6e026a3363e0954ede7bef0cfe88d4475de137","contentHash":"f180f2766f26444b72c5fcd4bb9bf9259658278a71e89e9a7a2d5af70caa317c","treeHash":"8c2af68bdb0779a2f369d1c05c1dfd8a94eb463650e926f416895f7bb9b79fb7","pluginPath":"skills/internet-court/starknet-js","auditPayloadHash":"ed20ac50431ac040f11277eeb4bc75a3"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"unavailable","url":null,"status":null},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"unavailable","verificationState":"not_verified"},"isLatest":false}}