📦

treasures

Name: treasures
Author: starchild-ai-agent

v1.0.3 Inhaltsrevision r1 Hohes Risiko ⚙️ Externe Befehle🌐 Netzwerkzugriff🔑 Umgebungsvariablen

Manage Tokenized Stock and USDC Operations

Tokenized asset workflows combine multiple APIs, wallets, chains, signatures, and jurisdiction rules. This skill organizes Treasures Finance discovery, portfolio, quote, trade, bridge, and troubleshooting steps.

Unterstützt: Claude Codex Code(CC)

⚠️ 38 Schlecht

Vor der Installation anhalten und eine Bestätigung anfordern.

Prüfen Sie den Plan und holen Sie vor Änderungen an Dateien die ausdrückliche Zustimmung des Benutzers ein.

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "treasures" from https://skillstore.io/skills/starchild-ai-agent-treasures.md and its manifest at https://skillstore.io/api/skills/starchild-ai-agent-treasures/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/starchild-ai-agent-treasures.md Signiertes manifest GET /api/skills/starchild-ai-agent-treasures/manifest Signiertes lockfile GET /api/skills/starchild-ai-agent-treasures/lockfile

Testen

„treasures“ wird verwendet. Summarize the portfolio for an Ethereum wallet without making changes.

Erwartetes Ergebnis:

Wallet network: Ethereum
Tokenized equity positions: GOOGL and NVDA
Settlement asset: USDC
Action taken: None

„treasures“ wird verwendet. Prepare a quote to sell 0.01 GOOGL with one percent maximum slippage.

Erwartetes Ergebnis:

Quote preparation is ready. Confirm wallet, jurisdiction eligibility, expected proceeds, fees, and slippage before any signature or submission.

„treasures“ wird verwendet. Explain why the quote returned HTTP 451.

Erwartetes Ergebnis:

The request reached a geographic access control before authentication. Do not treat this as a signature error or bypass an eligibility restriction.

Sicherheitsaudit

Hohes Risiko

v1 • 27.7.2026 Versionsbericht öffnen

All 54 static alerts are false positives caused by Markdown formatting, expected API examples, defensive proxy guidance, and an HTTP error code. However, the skill explicitly teaches agents to route geo-fenced securities requests through VPN exits. A prose warning cannot enforce eligibility, so these bypass instructions create material legal and financial abuse risk.

Gescannte Dateien

160

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Hoch

SKILL.md:50-86 SKILL.md:118-136

Geographic Access Control Circumvention

The skill directs agents to route geo-fenced securities requests through VPN exits in other countries. Its advisory eligibility warning cannot prevent restricted users from applying the bypass.

The file names blocked and clear countries, provides a proxy service, and supplies commands for routing restricted trade paths through alternate exits.

Hoch

SKILL.md:11 SKILL.md:101-112 SKILL.md:136

Financial Actions Lack a Mandatory Approval Gate

The skill directs wallet signing and transaction sequences without requiring fresh user confirmation before each signature or final submission. Ambiguous requests could cause unintended financial actions.

The instructions default to a wallet, sign an ownership challenge, and discuss trade submission, but no explicit approval checkpoint appears in the file.

Risikofaktoren

⚙️ Externe Befehle (37)

🌐 Netzwerkzugriff (15)

SKILL.md:99 SKILL.md:112 SKILL.md:43 SKILL.md:47 SKILL.md:48 SKILL.md:82 SKILL.md:84 SKILL.md:92 SKILL.md:93 SKILL.md:119 SKILL.md:120 SKILL.md:124 SKILL.md:149 SKILL.md:61 SKILL.md:131

🔑 Umgebungsvariablen (1)

SKILL.md:94

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/starchild-ai-agent-treasures/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/starchild-ai-agent-treasures/security.svg)](https://skillstore.io/skills/starchild-ai-agent-treasures?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/starchild-ai-agent-treasures?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/starchild-ai-agent-treasures/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/starchild-ai-agent-treasures.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

starchild-ai-agent. (2026). treasures security audit report (audit version 1) [Author version 1.0.3]. Skillstore. https://skillstore.io/skills/starchild-ai-agent-treasures/audits/1

BibTeX-Zitat

@techreport{starchild-ai-agent-starchild-ai-agent-treasures-2026,
  author = {starchild-ai-agent},
  title = {treasures security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/starchild-ai-agent-treasures/audits/1},
  note = {Author version 1.0.3}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "treasures security audit report (audit version 1)"
version: "1.0.3"
type: report
authors:
  - name: "starchild-ai-agent"
date-released: "2026-07-27"
url: "https://skillstore.io/skills/starchild-ai-agent-treasures/audits/1"
identifiers:
  - type: other
    value: "skillstore:starchild-ai-agent-treasures:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

100

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Review a Wallet Portfolio

Summarize tokenized stock positions and trade history without preparing a transaction.

Prepare an Eligible Trade

Collect a quote, validate the wallet and chain, then present details for approval before execution.

Diagnose API Failures

Separate routing, request schema, signature, and insufficient holdings errors during integration testing.

Diese Prompts ausprobieren

List Available Stocks

List the tokenized stocks available through Treasures Finance. Show ticker, provider, supported chain, and quote currency. Use read-only endpoints.

Summarize a Portfolio

Review the Treasures portfolio for wallet [address] on [chain]. Summarize positions and recent trades. Do not sign or submit anything.

Prepare a Trade Quote

For an eligible user in [jurisdiction], prepare a [buy or sell] quote for [ticker] and [amount]. Present all costs and await approval.

Plan a Cross-Chain Operation

Plan a USDC bridge from [source chain] to [destination chain], followed by a [ticker] trade. Identify every approval, signature, fee, and failure checkpoint.

Bewährte Praktiken

Verify jurisdiction, KYC status, and token eligibility before requesting a trade quote.
Require explicit user approval immediately before every wallet signature and transaction submission.
Confirm wallet, chain, ticker, amount, fees, slippage, and destination at each step.

Vermeiden

Do not use a VPN to bypass a geographic or securities eligibility restriction.
Do not set a global HTTP_PROXY value for all agent traffic.
Do not select a wallet API without confirming where the user assets are held.

Häufig gestellte Fragen

Can this skill execute trades?

It documents quote and execution workflows. Actual execution needs the referenced APIs, wallet access, and explicit user approval.

Which networks are covered?

The instructions cover Ethereum and Solana for tokenized equities and USDC operations.

Which wallet route should I use?

Use the public B2B route for user-owned wallets. Use the delegated route only when the user explicitly selects a Treasures wallet.

What does an HTTP 451 response mean?

It indicates a geographic access restriction before authentication. Confirm eligibility and do not bypass the restriction.

Does the skill require credentials?

Public workflows require wallet signatures. Delegated workflows may require a Treasures API key.

Does this skill provide financial or legal advice?

No. Users must independently verify asset terms, pricing, tax treatment, and jurisdiction eligibility.

Entwicklerdetails

Autor

starchild-ai-agent

Lizenz

MIT

Autorenversion

v1.0.3

Skillstore-Revision

Repository

https://github.com/starchild-ai-agent/official-skills/tree/488c1366cccbc16e044330e29df99bd995a18339/treasures

Ref.

7014d51800335b375ec9e0068a94267aaef4015b

Aktualität der Wartung

28.7.2026

Nutzung

1 Downloads · 1 Aufrufe

Dateistruktur

📄 logo.png

📄 SKILL.md