Skills altllm-portal-auth

📦

altllm-portal-auth

Name: altllm-portal-auth
Author: internet-court

Content revision r1 High Risk 🌐 Network access📁 Filesystem access🔑 Env variables⚙️ External commands

Authenticate AltLLM Wallet Sessions

Wallet login can expose private keys or create confusing local sessions. This skill guides safer AltLLM Portal authentication, external signing, status checks, and logout.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "altllm-portal-auth" from https://skillstore.io/skills/internet-court-altllm-portal-auth.md and its manifest at https://skillstore.io/api/skills/internet-court-altllm-portal-auth/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/internet-court-altllm-portal-auth.md Signed manifest GET /api/skills/internet-court-altllm-portal-auth/manifest Signed lockfile GET /api/skills/internet-court-altllm-portal-auth/lockfile

Test it

Using "altllm-portal-auth". Prepare a wallet challenge for the default AltLLM Portal API.

Expected outcome:

The assistant returns the challenge message, nonce, expiration, and signing instructions, then stops before any private-key use.

Using "altllm-portal-auth". Check my saved Portal login before deployment.

Expected outcome:

The assistant reports the saved user, session origin, target origin, and forwarding status without revealing the session token.

Using "altllm-portal-auth". Log out of my local Portal wallet session.

Expected outcome:

The assistant removes the local session file and explains that API keys are not revoked by local logout.

Security Audit

High Risk

v2 • 7/21/2026 Open versioned report

The skill documents wallet authentication, including access to private keys and storage of a local Portal session. The primary risks are intentional credential handling, an explicitly unsafe argv option, and unreviewed shared instructions outside this package. Hardcoded URLs and Markdown command formatting are benign in context.

Files scanned

168

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (4)

High

SKILL.md:21

Crypto seed/private key mention

| `login-wallet --private-key-env <name>` | Sign in with a locally available private key from an env

The workflow authorizes use of a wallet private key from an environment variable. A compromised environment can expose the wallet credential.

High

SKILL.md:22

Crypto seed/private key mention

| `login-wallet --private-key-file <path>` | Sign in with a locally available private key from a fil

The workflow authorizes reading a wallet private key from a file. The key file must be selected and protected carefully.

High

SKILL.md:23

Crypto seed/private key mention

| `login-wallet --private-key <hex> --allow-unsafe-private-key-argv` | Sign in with an inline privat

The workflow permits an inline private key in command arguments when an unsafe flag is supplied. Arguments can leak through process listings and shell history.

Medium

SKILL.md:13-15

Unreviewed Shared-Instruction Dependency

The skill instructs agents to read two parent-directory shared files before use, but those files are outside the audited package. Their contents could introduce unsafe commands or prompt-injection instructions after publication.

The explicit precondition to read external shared files is present, while the audit covers only two package files. Their content and safety cannot be verified from this skill.

Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/cli-reference.md:8

Generic API/secret keys

ALTLLM_WALLET_PRIVATE_KEY=<private-key> \

The command reads a wallet private key from an environment variable to sign in. A private key is highly sensitive and exposure can compromise the wallet.

High

references/cli-reference.md:12

Generic API/secret keys

--private-key-env ALTLLM_WALLET_PRIVATE_KEY

The command explicitly selects an environment variable containing a wallet private key. This is sensitive credential access, even though it is a safer input method than argv.

High

references/cli-reference.md:31

Generic API/secret keys

- `ALTLLM_WALLET_PRIVATE_KEY=<private-key>` with the default `--private-key-env ALTLLM_WALLET_PRIVAT

The reference documents private-key environment-variable input. Handling this credential presents a material wallet-compromise risk if the environment is exposed.

High

SKILL.md:14

Path traversal sequence

> - `../_shared/preflight.md`

The skill directs the agent to read a file outside the skill directory. The referenced content is not included in this audit, so it creates an unreviewed instruction dependency.

High

SKILL.md:15

Path traversal sequence

> - `../_shared/session-and-target.md`

The skill directs the agent to read a second parent-directory file. Its unreviewed content could alter behavior outside the audited package.

High

SKILL.md:38

Hidden file in home directory

- Save the resulting session to `~/.altllm/portal-cli-session.json` unless overridden.

The skill directs storage of an authenticated Portal session under the user home directory. Session credentials require restrictive permissions and explicit user consent.

Medium

references/cli-reference.md:20

Hidden file access

"sessionFile": "/Users/<user>/.altllm/portal-cli-session.json",

The documented workflow stores an authentication session in a hidden home-directory file. Session-token storage is sensitive and requires secure permissions and user awareness.

Medium

references/cli-reference.md:113

Hidden file access

"sessionFile": "/Users/<user>/.altllm/portal-cli-session.json",

Representative logout output identifies the hidden session file. The file can contain authentication state and must be protected from other local users.

Medium

SKILL.md:38

Hidden file access

- Save the resulting session to `~/.altllm/portal-cli-session.json` unless overridden.

The skill directs storage of an authenticated Portal session in a hidden file. This is sensitive local authentication state.

Risk Factors

🌐 Network access (6)

references/cli-reference.md:10 references/cli-reference.md:40 references/cli-reference.md:50 references/cli-reference.md:64 references/cli-reference.md:85 references/cli-reference.md:119

📁 Filesystem access (6)

references/cli-reference.md:20 references/cli-reference.md:113 SKILL.md:14 SKILL.md:15 SKILL.md:38 SKILL.md:38

🔑 Env variables (3)

references/cli-reference.md:8 references/cli-reference.md:12 references/cli-reference.md:31

⚙️ External commands (16)

SKILL.md:9 SKILL.md:13 SKILL.md:14 SKILL.md:15 SKILL.md:21 SKILL.md:22 SKILL.md:23 SKILL.md:24 SKILL.md:25 SKILL.md:26 SKILL.md:27 SKILL.md:34 SKILL.md:36 SKILL.md:38 SKILL.md:39 SKILL.md:40

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/internet-court-altllm-portal-auth/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/internet-court-altllm-portal-auth/security.svg)](https://skillstore.io/skills/internet-court-altllm-portal-auth?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/internet-court-altllm-portal-auth?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-altllm-portal-auth/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/internet-court-altllm-portal-auth.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

internet-court. (2026). altllm-portal-auth security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/internet-court-altllm-portal-auth/audits/2

BibTeX citation

@techreport{internet-court-internet-court-altllm-portal-auth-2026,
  author = {internet-court},
  title = {altllm-portal-auth security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/internet-court-altllm-portal-auth/audits/2},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "altllm-portal-auth security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
  - name: "internet-court"
date-released: "2026-07-21"
url: "https://skillstore.io/skills/internet-court-altllm-portal-auth/audits/2"
identifiers:
  - type: other
    value: "skillstore:internet-court-altllm-portal-auth:audit:2"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Connect a Developer Wallet

Prepare and complete an AltLLM Portal wallet login without placing private keys in command arguments.

Troubleshoot Local Session State

Check the saved user, target origin, and forwarding status before running live CLI commands.

Use External Signing

Fetch a challenge for a wallet provider such as Privy, then verify the returned signature.

Try These Prompts

Check My Session

Use altllm-portal-auth to check whether my saved Portal wallet session is valid before I run live commands.

Prepare Wallet Challenge

Use altllm-portal-auth to prepare a login challenge for my wallet address. Stop after returning the challenge details for external signing.

Verify Signed Challenge

Use altllm-portal-auth to verify my signed challenge with the nonce and signature I provide, then confirm the saved session status.

Review Host Safety

Use altllm-portal-auth to plan wallet login for a non-default AltLLM API host. Prefer external signing and identify private-key exposure risks.

Best Practices

Prefer challenge preparation and external signing when a wallet provider is available.
Verify wallet address, chain, nonce, challenge host, and expiration before signing.
Check session status before live commands and protect the saved session file.

Avoid

Passing private keys directly in command arguments.
Auto-signing against non-default remote API hosts without reviewing the challenge.
Assuming local logout revokes server credentials or API keys.

Frequently Asked Questions

What does this skill help with?

It helps with AltLLM Portal wallet login, challenge preparation, signature verification, session status, and local logout.

Does it require my private key?

No. The preferred flow prepares a challenge so your wallet or provider can sign externally.

Can it work with Privy?

Yes. Privy can be used when it returns a standard wallet signature for the challenge message.

Where is the session stored?

The documented default path is a Portal CLI session file under the user home directory.

Does status reveal the token?

No. The documented status command reports user and target details without printing the session token.

Does logout revoke API keys?

No. Local logout removes the saved session file. It does not revoke API keys.

Developer Details

Author

internet-court

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/internet-court/internet-court-skill/tree/main/vendored/altlayer/altllm-portal-auth

Ref

3f6e026a3363e0954ede7bef0cfe88d4475de137

Maintenance freshness

7/21/2026

Usage

1 downloads · 0 views

File structure

📁 references/

📄 cli-reference.md

📄 SKILL.md