Skills alkahest-user
📦

alkahest-user

Content revision r1 High Risk ⚙️ External commands🌐 Network access🔑 Env variables

Manage Alkahest Escrow Workflows

Alkahest workflows require precise CLI commands and contract context. This skill guides escrow, payment, arbitration, and attestation operations for protocol users.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "alkahest-user" from https://skillstore.io/skills/internet-court-alkahest-user.md and its manifest at https://skillstore.io/api/skills/internet-court-alkahest-user/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/internet-court-alkahest-user.md Signed manifest GET /api/skills/internet-court-alkahest-user/manifest Signed lockfile GET /api/skills/internet-court-alkahest-user/lockfile

Test it

Using "alkahest-user". I need to create an ERC20 escrow for a service milestone.

Expected outcome:

The response identifies required addresses, token amount, arbiter choice, demand data, expiration, approval risk, and confirmation checks.

Using "alkahest-user". I am an oracle reviewing a fulfillment.

Expected outcome:

The response separates evidence review from transaction submission and lists the demand, obligation UID, decision, and safety checks.

Using "alkahest-user". I need to understand commit-reveal before using it.

Expected outcome:

The response explains commitment creation, bond submission, reveal timing, bond recovery, and when slashing can occur.

Security Audit

High Risk
v2 • 7/21/2026 Open versioned report

Most static findings are false positives caused by Markdown backticks, placeholder examples, and blockchain identifiers. The skill documents unsafe wallet-secret delivery through CLI arguments and environment variables, and it lacks safety checks for irreversible asset operations. Review is required before publication.

4
Files scanned
1,007
Lines analyzed
2
Review items
0
False positives ignored

Confirmed security concerns (5)

High
SKILL.md:42
Crypto seed/private key mention
| Private key flag | `--private-key 0x...` |
The documentation recommends supplying wallet private keys or mnemonics through CLI arguments or environment variables. CLI arguments can be retained in shell history or exposed to local process inspection, and environment variables can leak to child processes.
High
SKILL.md:43
Crypto seed/private key mention
| Mnemonic flag | `--mnemonic "word1 word2 ..."` |
The documentation recommends supplying wallet private keys or mnemonics through CLI arguments or environment variables. CLI arguments can be retained in shell history or exposed to local process inspection, and environment variables can leak to child processes.
High
SKILL.md:45
Crypto seed/private key mention
| Private key env | `ALKAHEST_PRIVATE_KEY=0x...` |
The documentation recommends supplying wallet private keys or mnemonics through CLI arguments or environment variables. CLI arguments can be retained in shell history or exposed to local process inspection, and environment variables can leak to child processes.
High
SKILL.md:46
Crypto seed/private key mention
| Mnemonic env | `ALKAHEST_MNEMONIC="word1 word2 ..."` |
The documentation recommends supplying wallet private keys or mnemonics through CLI arguments or environment variables. CLI arguments can be retained in shell history or exposed to local process inspection, and environment variables can leak to child processes.
High
SKILL.md:87-116SKILL.md:147-182SKILL.md:189-200SKILL.md:219-237
Irreversible asset operations lack verification guidance
The workflow examples create escrows, approve token spending, collect assets, arbitrate, and slash bonds without requiring users to verify chain, contract addresses, token amounts, or transaction simulation before signing. Incorrect inputs can cause irreversible on-chain asset loss.
These sections explicitly document signing asset-moving, approval, arbitration, and bond-slashing actions, but include no pre-signing verification or simulation step. The risk follows directly from the irreversible EVM transaction model.
Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
SKILL.md:45
Generic API/secret keys
| Private key env | `ALKAHEST_PRIVATE_KEY=0x...` |
The documentation recommends supplying wallet private keys or mnemonics through CLI arguments or environment variables. CLI arguments can be retained in shell history or exposed to local process inspection, and environment variables can leak to child processes.
High
SKILL.md:47
Generic API/secret keys
| Compat env | `PRIVATE_KEY=0x...` |
The documentation recommends supplying wallet private keys or mnemonics through CLI arguments or environment variables. CLI arguments can be retained in shell history or exposed to local process inspection, and environment variables can leak to child processes.

Risk Factors

⚙️ External commands (50)
references/typescript-sdk.md:113-116 SKILL.md:30 SKILL.md:32-34 SKILL.md:34-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44-45 SKILL.md:45-46 SKILL.md:46-47 SKILL.md:47-51 SKILL.md:51-55 SKILL.md:55-61 SKILL.md:61-64 SKILL.md:64-66 SKILL.md:66-74 SKILL.md:74-81 SKILL.md:81-85 SKILL.md:85 SKILL.md:87-117 SKILL.md:117-119 SKILL.md:119 SKILL.md:123-127 SKILL.md:127-131 SKILL.md:131-134 SKILL.md:134-138 SKILL.md:138-141 SKILL.md:141-147 SKILL.md:147-165 SKILL.md:165-169 SKILL.md:169-183 SKILL.md:183-185 SKILL.md:185 SKILL.md:189-201 SKILL.md:201-203 SKILL.md:203-209 SKILL.md:209-238 SKILL.md:238-242 SKILL.md:242-244 SKILL.md:244-261 SKILL.md:261-263 SKILL.md:263 SKILL.md:267-271 SKILL.md:271-277 SKILL.md:277-289 SKILL.md:289-291 SKILL.md:291 SKILL.md:295-312 SKILL.md:312-316 SKILL.md:316-323 SKILL.md:323-325
🌐 Network access (1)
references/typescript-sdk.md:16
🔑 Env variables (3)
references/typescript-sdk.md:14 SKILL.md:45 SKILL.md:47
Audited by: claude View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/internet-court-alkahest-user/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/internet-court-alkahest-user/security.svg)](https://skillstore.io/skills/internet-court-alkahest-user?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/internet-court-alkahest-user?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-alkahest-user/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/internet-court-alkahest-user.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

internet-court. (2026). alkahest-user security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/internet-court-alkahest-user/audits/2

BibTeX citation

@techreport{internet-court-internet-court-alkahest-user-2026, author = {internet-court}, title = {alkahest-user security audit report (audit version 2)}, institution = {Skillstore}, year = {2026}, number = {2}, url = {https://skillstore.io/skills/internet-court-alkahest-user/audits/2}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "alkahest-user security audit report (audit version 2)" version: "unspecified" type: report authors: - name: "internet-court" date-released: "2026-07-21" url: "https://skillstore.io/skills/internet-court-alkahest-user/audits/2" identifiers: - type: other value: "skillstore:internet-court-alkahest-user:audit:2" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
45
Architecture
85
Maintainability
87
Content
65
Community
83
Spec Compliance

What You Can Build

Buyer escrow setup

Plan an Alkahest escrow and identify the demand, arbiter, token, amount, expiration, and approval steps.

Seller fulfillment

Follow the fulfillment, oracle arbitration, and collection flow for an escrow tied to delivered work.

Oracle operation

Prepare manual or automated oracle decisions with attention to demand data and fulfillment attestations.

Try These Prompts

Understand buyer flow 
Explain the Alkahest buyer flow for an ERC20 escrow on Base Sepolia. List the inputs I must confirm before any transaction.
Prepare seller fulfillment 
Help me prepare a seller fulfillment plan for an existing escrow UID. Include the fulfillment, arbitration, and collection checkpoints.
Choose an arbiter 
Compare trusted oracle, confirmation, and commit-reveal arbiters for my escrow. Recommend the safest option for off-chain deliverables.
Design oracle automation 
Design an auto-arbitration review workflow using the TypeScript SDK. Include manual safeguards before any on-chain decision is submitted.

Best Practices

  • Use testnets and small amounts before mainnet operations.
  • Prefer hardware wallets or scoped keys for any signing workflow.
  • Verify contract addresses, token amounts, arbiters, and recipients before approving transactions.

Avoid

  • Do not paste production private keys or mnemonics into prompts or shared terminals.
  • Do not run auto-arbitration without a written decision policy and manual override.
  • Do not approve token transfers until token addresses and spender contracts are verified.

Frequently Asked Questions

What is Alkahest?
Alkahest is an EAS-based escrow protocol for trustless exchanges on EVM chains.
Does this skill execute transactions by itself?
No. It provides guidance and command examples. Users or agents must still run external tools and sign transactions.
Which roles does it support?
It supports buyer, seller, and oracle workflows for escrow creation, fulfillment, arbitration, collection, and reclaim actions.
Can it help with TypeScript SDK workflows?
Yes. It includes SDK references for escrow, payments, commit-reveal, demand composition, and auto-arbitration.
What should I protect most?
Protect private keys, mnemonics, RPC credentials, token approvals, recipient addresses, and oracle decision authority.
Is it safe for mainnet use?
Mainnet use requires independent verification of addresses, amounts, chain settings, and contract versions before signing.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/internet-court/internet-court-skill/tree/main/vendored/arkhai/alkahest-user

Ref

3f6e026a3363e0954ede7bef0cfe88d4475de137

Maintenance freshness

7/22/2026

Usage

1 downloads · 0 views

File structure

📁 references/

📄 arbiters.md

📄 contracts.md

📄 typescript-sdk.md

📄 SKILL.md