📦
Audit History
alkahest-developer - 2 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 2 Latest
Jul 21, 2026, 02:28 AM
All 118 static detections are false positives caused by Markdown formatting, SDK examples, placeholder RPC URLs, and placeholder private keys. The reviewed files contain no executable shell commands, credential exfiltration, or prompt-injection instructions. The skill documents blockchain operations, so users must independently validate transaction details before signing.
5
Files scanned
1,327
Lines analyzed
4
Review items
0
False positives ignored
Risk Factors
⚡ Contains scripts (4)
🌐 Network access (13)
🔑 Env variables (12)
⚙️ External commands (50)
references/typescript-api.md:43-44 references/typescript-api.md:44-45 references/typescript-api.md:45-47 references/typescript-api.md:47 references/typescript-api.md:49 references/typescript-api.md:50-51 references/typescript-api.md:51 references/typescript-api.md:52-54 SKILL.md:21 SKILL.md:22 SKILL.md:23 SKILL.md:29-52 SKILL.md:52-56 SKILL.md:56-77 SKILL.md:77-81 SKILL.md:81-91 SKILL.md:91-98 SKILL.md:98-109 SKILL.md:109-112 SKILL.md:112-121 SKILL.md:121-124 SKILL.md:124-134 SKILL.md:134-139 SKILL.md:139-145 SKILL.md:145-148 SKILL.md:148-152 SKILL.md:152-155 SKILL.md:155-160 SKILL.md:160-165 SKILL.md:165-170 SKILL.md:170-173 SKILL.md:173-177 SKILL.md:177-180 SKILL.md:180-182 SKILL.md:182-187 SKILL.md:187-192 SKILL.md:192-195 SKILL.md:195-201 SKILL.md:201-204 SKILL.md:204-209 SKILL.md:209-214 SKILL.md:214-230 SKILL.md:230-233 SKILL.md:233-240 SKILL.md:240-243 SKILL.md:243-252 SKILL.md:252-257 SKILL.md:257-268 SKILL.md:268-271 SKILL.md:271-278
Audited by: claude
Jul 9, 2026, 11:39 PM
Most static findings are markdown or SDK reference false positives, including code fences, TypeScript template literal types, and blockchain UID fields. The audit confirms repeated inline private-key placeholders in setup examples as a real copy-paste safety risk for wallet code. No prompt injection, data-exfiltration intent, or unauthorized command execution evidence was found.
5
Files scanned
1,327
Lines analyzed
17
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Crypto seed/private key mention
account: privateKeyToAccount("0xKEY"),
The example passes private-key material as an inline string during wallet or client setup. The value is a placeholder, not a leaked key, but the copy-paste pattern is unsafe for blockchain wallet code.
High
Crypto seed/private key mention
account: privateKeyToAccount("0xPRIVATE_KEY"),
The example passes private-key material as an inline string during wallet or client setup. The value is a placeholder, not a leaked key, but the copy-paste pattern is unsafe for blockchain wallet code.
Capability review items (11)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys · 2 occurrences
client = PyAlkahestClient("0xPRIVATE_KEY", "https://rpc-url")
The example passes private-key material as an inline string during wallet or client setup. The value is a placeholder, not a leaked key, but the copy-paste pattern is unsafe for blockchain wallet code.
High
Generic API/secret keys · 2 occurrences
client = PyAlkahestClient("0xPRIVATE_KEY", "https://rpc-url", config)
The example passes private-key material as an inline string during wallet or client setup. The value is a placeholder, not a leaked key, but the copy-paste pattern is unsafe for blockchain wallet code.
High
Generic API/secret keys · 4 occurrences
"0xPRIVATE_KEY",
The example passes private-key material as an inline string during wallet or client setup. The value is a placeholder, not a leaked key, but the copy-paste pattern is unsafe for blockchain wallet code.
High
Generic API/secret keys · 2 occurrences
let bare = AlkahestClient::new("0xPRIVATE_KEY", "https://rpc-url").await?;
The example passes private-key material as an inline string during wallet or client setup. The value is a placeholder, not a leaked key, but the copy-paste pattern is unsafe for blockchain wallet code.
High
Generic API/secret keys
account: privateKeyToAccount("0xPRIVATE_KEY"),
The example passes private-key material as an inline string during wallet or client setup. The value is a placeholder, not a leaked key, but the copy-paste pattern is unsafe for blockchain wallet code.
Risk Factors
⚡ Contains scripts (4)
🌐 Network access (13)
🔑 Env variables (12)
⚙️ External commands (50)
references/typescript-api.md:43-44 references/typescript-api.md:44-45 references/typescript-api.md:45-47 references/typescript-api.md:47 references/typescript-api.md:49 references/typescript-api.md:50-51 references/typescript-api.md:51 references/typescript-api.md:52-54 SKILL.md:21 SKILL.md:22 SKILL.md:23 SKILL.md:29-52 SKILL.md:52-56 SKILL.md:56-77 SKILL.md:77-81 SKILL.md:81-91 SKILL.md:91-98 SKILL.md:98-109 SKILL.md:109-112 SKILL.md:112-121 SKILL.md:121-124 SKILL.md:124-134 SKILL.md:134-139 SKILL.md:139-145 SKILL.md:145-148 SKILL.md:148-152 SKILL.md:152-155 SKILL.md:155-160 SKILL.md:160-165 SKILL.md:165-170 SKILL.md:170-173 SKILL.md:173-177 SKILL.md:177-180 SKILL.md:180-182 SKILL.md:182-187 SKILL.md:187-192 SKILL.md:192-195 SKILL.md:195-201 SKILL.md:201-204 SKILL.md:204-209 SKILL.md:209-214 SKILL.md:214-230 SKILL.md:230-233 SKILL.md:233-240 SKILL.md:240-243 SKILL.md:243-252 SKILL.md:252-257 SKILL.md:257-268 SKILL.md:268-271 SKILL.md:271-278
Audited by: codex