このレポートには指定された言語の翻訳がありません。代わりに正規の英語レポートを表示しています。
バージョン付きセキュリティ評価
レポートID: SA-0F4EAF40
7/9/2026, 11:43:36 PM
near-kit セキュリティ評価 v1
スキルセキュリティ認証レポート
監査モデル: codex 過去のレポート
- スキル名
- near-kit
- バージョン
- v1
- メンテナー
- internet-court
- カバレッジ
- 5 スキャンされたファイル · 1,524 解析済み行数
- ポリシーバージョン
- 利用不可
確認済みの検出結果における最高重大度
高
38 件の確認済みセキュリティ検出結果に対応が必要です。
インストールのコンテキスト
履歴上の証拠
このレポートは、現在インストール可能な成果物を説明していない可能性があります。インストールに関するガイダンスについては、現在の Skill ページを開いてください。
現在のスキルページを開くこのレポートは、マニフェストまたは ZIP をブロックも承認もしません。
The skill is documentation for near-kit and I found no prompt injection or malware intent. Most static hits are false positives from Markdown fences, TypeScript template strings, placeholder URLs, and local example APIs. Key handling examples and ~/.near-credentials access are real sensitive-use risks that need stronger warnings.
レポートの位置
過去のレポート
このレポートを使用してインストールする前に、監査履歴を開いてください。
監査アテステーション
証明不可
必要な不変のバインディングは不完全です。
人による検証
未検証
このレポートには人による検証は記録されていません。
カバレッジ
5 スキャンされたファイル · 1,524 解析済み行数
レビュー対象の項目を 42 件表示
制限事項
このレポートはランタイムまたはサンドボックスでの実行を主張するものではなく、副作用がないことを証明するものでもありません。
証拠チェーン
ソースバインディングからインストール契約まで証拠をたどってください。利用可能な証拠は検証を支援しますが、安全性を保証するものではありません。
ソース
バインディングは利用できません
アーティファクト
IDが不完全
監査
完了
確認された機能
「確認」とは、このレポートで裏付けとなる証拠が記録されていることを意味します。「記録なし」は、機能が存在しないことを証明するものではありません。
スクリプトを含む
Skillに含まれるコードを実行する場合があります。
この監査では記録されていません
ネットワークアクセス
外部サービスに接続する場合があります。
4 件の証拠箇所で確認
ファイルシステムへのアクセス
ローカルファイルの読み取りまたは書き込みを行う可能性があります。
4 件の証拠箇所で確認
環境変数
プロセス環境から値を読み取る可能性があります。
この監査では記録されていません
外部コマンド
Skillの外部にあるコマンドまたはプログラムを呼び出す場合があります。
41 件の証拠箇所で確認
機能レビュー項目 (4)
高
Hidden file in home directory
keyStore: new FileKeyStore("~/.near-credentials", "mainnet"),
The documentation uses FileKeyStore with ~/.near-credentials, a hidden home-directory credential store. That path can contain wallet keys, so the access pattern is a real sensitive-filesystem risk.
高
Hidden file access
keyStore: new FileKeyStore("~/.near-credentials", "mainnet"),
The documentation uses FileKeyStore with ~/.near-credentials, a hidden home-directory credential store. That path can contain wallet keys, so the access pattern is a real sensitive-filesystem risk.
高
Hidden file in home directory
keyStore: new FileKeyStore("~/.near-credentials", "testnet"),
The documentation uses FileKeyStore with ~/.near-credentials, a hidden home-directory credential store. That path can contain wallet keys, so the access pattern is a real sensitive-filesystem risk.
高
Hidden file access
keyStore: new FileKeyStore("~/.near-credentials", "testnet"),
The documentation uses FileKeyStore with ~/.near-credentials, a hidden home-directory credential store. That path can contain wallet keys, so the access pattern is a real sensitive-filesystem risk.
リスク指摘
確認済みのセキュリティ上の懸念事項は、引き続きレビューが必要な項目と分けて表示されます。
確認済みのセキュリティ上の懸念 (38)
RISK-001 高
Crypto seed/private key mention
privateKey: "ed25519:...",
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-002 高
Crypto seed/private key mention
### Direct Private Key
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-003 高
Crypto seed/private key mention
privateKey: "ed25519:...",
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-004 高
Crypto seed/private key mention
generateSeedPhrase,
The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.
RISK-005 高
Crypto seed/private key mention
parseSeedPhrase,
The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.
RISK-006 高
Crypto seed/private key mention
isPrivateKey,
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-007 高
Crypto seed/private key mention
validatePrivateKey,
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-008 高
Crypto seed/private key mention
### generateSeedPhrase()
The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.
RISK-009 高
Crypto seed/private key mention
const seedPhrase = generateSeedPhrase();
The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.
RISK-010 高
Crypto seed/private key mention
### parseSeedPhrase()
The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.
RISK-011 高
Crypto seed/private key mention
const keyPair = parseSeedPhrase(seedPhrase);
The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.
RISK-012 高
Crypto seed/private key mention
### Full Seed Phrase Flow
The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.
RISK-013 高
Crypto seed/private key mention
import { Near, generateSeedPhrase, parseSeedPhrase } from "near-kit";
The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.
RISK-014 高
Crypto seed/private key mention
privateKey: "ed25519:...",
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-015 高
Crypto seed/private key mention
// Generate seed phrase (returns a string)
The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.
RISK-016 高
Crypto seed/private key mention
const seedPhrase = generateSeedPhrase();
The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.
RISK-017 高
Crypto seed/private key mention
const keyPair = parseSeedPhrase(seedPhrase);
The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.
RISK-018 高
Crypto seed/private key mention
isPrivateKey("ed25519:..."); // true
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-019 高
Crypto seed/private key mention
validatePrivateKey("ed25519:..."); // throws if invalid
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-020 高
Crypto seed/private key mention
privateKey: "ed25519:...",
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-021 高
Crypto seed/private key mention
const near = new Near({ network: "testnet", privateKey: "..." })
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-022 高
Crypto seed/private key mention
privateKey: "ed25519:...",
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-023 高
Crypto seed/private key mention
privateKey: "ed25519:...",
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-024 高
Crypto seed/private key mention
.signWith(privateKey) // specify which key signs
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-025 高
Crypto seed/private key mention
import { Near, fromHotConnect, fromWalletSelector, type WalletConnection, type PrivateKey } from "ne
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-026 高
Crypto seed/private key mention
| { env: "server"; privateKey: PrivateKey; signerId: string }
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-027 高
Crypto seed/private key mention
privateKey: config.privateKey,
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-028 高
Crypto seed/private key mention
privateKey: "ed25519:...",
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-029 高
Crypto seed/private key mention
privateKey: "ed25519:...",
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-030 高
Crypto seed/private key mention
import { generateKey, parseSeedPhrase, generateSeedPhrase } from "near-kit";
The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.
RISK-031 高
Crypto seed/private key mention
// Direct private key
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-032 高
Crypto seed/private key mention
privateKey: "ed25519:...",
The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.
RISK-033 高
Crypto seed/private key mention
generateSeedPhrase,
The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.
RISK-034 高
Crypto seed/private key mention
parseSeedPhrase,
The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.
RISK-035 高
Crypto seed/private key mention
// generateSeedPhrase() returns a string (just the phrase)
The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.
RISK-036 高
Crypto seed/private key mention
const seedPhrase = generateSeedPhrase();
The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.
RISK-037 高
Crypto seed/private key mention
// parseSeedPhrase() returns a KeyPair-like object
The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.
RISK-038 高
Crypto seed/private key mention
const keyPair = parseSeedPhrase("word1 word2 ... word12");
The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.
是正措置
この監査で推奨される修正が記録されています。これらを適用する責任はメンテナーにあります。
- FIX-001高Direct private key and seed phrase examplesAdd clear warnings to never paste real secrets into prompts, logs, or source files. Prefer wallet adapters, secret managers, or restricted function-call keys.
- FIX-002高File-based keystore under ~/.near-credentialsDocument permissions, testnet-only examples, backup risks, and safer alternatives such as OS keyrings or explicit user-selected paths.
- FIX-003高Browser and React examples near private key configurationState that browser code should use wallet adapters only. Keep private keys in trusted server processes or managed key stores.
- FIX-004中Login and relayer examples post signed payloads to APIsRequire nonce expiration, recipient matching, payload validation, and replay protection in all NEP-413 and NEP-366 server examples.
専門家による証拠
不変の対象ID、スキャナーメタデータ、除外された一致項目、およびソースレベルの証拠。
アーティファクト主体
- Marketplace コミット
- 利用不可
- コンテンツハッシュ
- 利用不可
- ツリーハッシュ
- 利用不可
- Skill パス
- 利用不可
- 監査ペイロードハッシュ
- 利用不可
分析メタデータ
監査モデル: codex
分析状態: 完了
対象範囲は、記録されたファイル、行、メソッド、および証拠に限定されます。ランタイムまたはサンドボックスでの実行は主張していません。
検証とエクスポート
マニフェストとロックファイルは、インストール成果物を暗号学的ハッシュに結び付けます。この完全性に関する主張は、セキュリティ評価とは別のものです。
監査アテステーション: not_attestable