Skills fulfill-git-escrow
๐Ÿ“ฆ

fulfill-git-escrow

v1.0 Content revision r1 High Risk โš™๏ธ External commands๐ŸŒ Network access๐Ÿ“ Filesystem access๐Ÿ”‘ Env variables

Fulfill Git Escrow Bounties

Git escrow bounties require careful test review, git handling, and blockchain CLI submission. This skill guides validation, solution preparation, fulfillment submission, and follow-up status checks.

Supports: Claude Codex Code(CC)
โš ๏ธ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "fulfill-git-escrow" from https://skillstore.io/skills/internet-court-fulfill-git-escrow.md and its manifest at https://skillstore.io/api/skills/internet-court-fulfill-git-escrow/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Test it

Using "fulfill-git-escrow". Inspect an open escrow before I start solving it.

Expected outcome:

  • A short escrow summary with status, reward, oracle, test source, and required next inputs.
  • A clear warning if wallet configuration or network access is missing.
  • A proposed next step before any transaction is submitted.

Using "fulfill-git-escrow". Submit my existing solution repository and commit.

Expected outcome:

  • A confirmation summary for the escrow UID, repository, and commit.
  • A fulfillment result that highlights the fulfillment UID when submission succeeds.
  • Follow-up guidance for checking status and collecting after approval.

Using "fulfill-git-escrow". Help me fix a failed escrow fulfillment.

Expected outcome:

  • A diagnosis of likely causes such as closed escrow, wrong network, inaccessible repository, or unregistered key.
  • A prioritized list of checks to run before retrying.
  • A concise explanation of what changed and what still needs user confirmation.

Security Audit

High Risk
v2 โ€ข 7/21/2026 Open versioned report

The skill legitimately automates Git escrow fulfillment, but it invokes third-party CLI commands, handles a blockchain private key, and clones external repositories. Several scanner hits are Markdown or metadata false positives. Publication requires safeguards for credential handling, repository trust, broad staging, and financial actions.

1
Files scanned
122
Lines analyzed
9
Review items
0
False positives ignored

Confirmed security concerns (4)

High
Environment file access
compatibility: Requires git-escrows CLI, git, a configured .env with PRIVATE_KEY, and network access
The documented .env configuration includes a PRIVATE_KEY, which is a sensitive credential used by the workflow.
High
Environment file access
Check if a `.env` file exists in the current directory. If not, tell the user they need one and sugg
The skill directs an agent to inspect whether a local .env file exists. Although content disclosure is not requested, it touches a sensitive configuration boundary.
High
Crypto seed/private key mention
git-escrows new-client --privateKey "0x..." --network "sepolia"
The example accepts a blockchain private key as a CLI argument. Command-line arguments may be exposed through shell history or process listings.
High
Unconfirmed financial submission
The workflow submits fulfillment data to an escrow system and later claims a token reward without requiring an explicit confirmation immediately before the state-changing action.
The documented fulfill and collect commands act on an escrow and reward workflow. The skill does not require a final user confirmation before those commands.
Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Ruby/shell backtick execution
2. Clone it to a temporary location: `git clone <url> /tmp/escrow-tests-<uid> && cd /tmp/escrow-test
The skill clones and checks out a repository URL and commit obtained from escrow data. Untrusted repository content is introduced into a local temporary directory.
High
Ruby/shell backtick execution
1. Stage and commit the solution: `git add -A && git commit -m "solution for escrow <uid>"`
git add -A stages every working-tree change before committing. It can unintentionally include credentials or unrelated files.
High
Generic API/secret keys
compatibility: Requires git-escrows CLI, git, a configured .env with PRIVATE_KEY, and network access
The skill requires a PRIVATE_KEY in a .env file for its signing workflow. A private key is highly sensitive.
High
Generic API/secret keys
primaryEnv: PRIVATE_KEY
The metadata explicitly declares PRIVATE_KEY as the primary environment value. This exposes a sensitive signing credential to the invoked workflow.
Medium
Ruby/shell backtick execution
Run `git-escrows --help` to verify the CLI is installed. If it fails, try `npx git-escrows --help` o
The skill instructs execution of a CLI and fallback package runners. These may install or execute third-party package code.
Medium
Ruby/shell backtick execution
Run `git-escrows list --verbose --format json` and find the escrow matching the provided UID. Confir
The instruction executes a third-party CLI that queries escrow details and can access the configured signing environment.
Medium
Ruby/shell backtick execution
If no escrow UID was provided, ask the user for one. You can help them browse with `git-escrows list
The instruction runs the escrow CLI to retrieve remote escrow data. This is an external command with network-facing behavior.
Medium
Ruby/shell backtick execution
- Suggest checking status with: `git-escrows list --verbose`
The instruction runs the third-party escrow CLI to query status. It is legitimate functionality but performs an external command.
Medium
Temp directory access
2. Clone it to a temporary location: `git clone <url> /tmp/escrow-tests-<uid> && cd /tmp/escrow-test
A repository is cloned into a predictable temporary path. This persists untrusted content locally and can collide with an existing path.
Audited by: claude View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/internet-court-fulfill-git-escrow/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/internet-court-fulfill-git-escrow/security.svg)](https://skillstore.io/skills/internet-court-fulfill-git-escrow?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/internet-court-fulfill-git-escrow?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-fulfill-git-escrow/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/internet-court-fulfill-git-escrow.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

internet-court. (2026). fulfill-git-escrow security audit report (audit version 2) [Author version 1.0]. Skillstore. https://skillstore.io/skills/internet-court-fulfill-git-escrow/audits/2

BibTeX citation

@techreport{internet-court-internet-court-fulfill-git-escrow-2026, author = {internet-court}, title = {fulfill-git-escrow security audit report (audit version 2)}, institution = {Skillstore}, year = {2026}, number = {2}, url = {https://skillstore.io/skills/internet-court-fulfill-git-escrow/audits/2}, note = {Author version 1.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "fulfill-git-escrow security audit report (audit version 2)" version: "1.0" type: report authors: - name: "internet-court" date-released: "2026-07-21" url: "https://skillstore.io/skills/internet-court-fulfill-git-escrow/audits/2" identifiers: - type: other value: "skillstore:internet-court-fulfill-git-escrow:audit:2" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
65
Community
83
Spec Compliance

What You Can Build

Solve a new escrow challenge

Implement code from test expectations and submit the resulting commit.

Submit an existing solution

Collect required repository and commit details, then submit them to an escrow.

Track fulfillment next steps

Report fulfillment identifiers and prepare status or collection follow-up.

Try These Prompts

Inspect an escrow
Use fulfill-git-escrow to inspect escrow UID <uid>. Summarize its status, test repository, reward, oracle, and missing information before running any submission step.
Prepare a solution workspace
Use fulfill-git-escrow in write mode for escrow UID <uid>. Review the test repository, identify expected files, and propose a solution plan before editing files.
Submit an existing solution
Use fulfill-git-escrow with escrow UID <uid>, solution repository <repo>, and solution commit <commit>. Confirm the details with me before submitting.
Diagnose a failed fulfillment
Use fulfill-git-escrow to analyze this failed fulfillment for escrow UID <uid>. Check status, network assumptions, key registration, repository accessibility, and next remediation steps.

Best Practices

  • Confirm escrow UID, network, repository URL, and commit hash before submission.
  • Keep private keys outside chat and review environment file handling manually.
  • Review git status and staged changes before committing or submitting a solution.

Avoid

  • Submitting fulfill or collect actions without explicit user approval.
  • Using broad git staging without checking which files will be committed.
  • Trusting unknown test repositories or generated commands without review.

Frequently Asked Questions

What does this skill do?
It guides an agent through validating a git escrow bounty, preparing a solution, submitting a commit, and reporting follow-up steps.
Does it require a wallet private key?
The underlying git-escrows workflow expects user-managed private key configuration. Do not paste private keys into chat.
Can it submit an existing solution?
Yes. Provide the escrow UID, solution repository, and solution commit so the agent can prepare the submission flow.
Can it write a new solution?
Yes. It can inspect the test repository, create expected files, commit changes, and prepare a fulfillment submission.
Does it guarantee reward collection?
No. The escrow oracle must accept the fulfillment before collection is possible.
What should I review before using it?
Review the escrow details, staged files, repository URL, commit hash, network, and any transaction prompt before proceeding.

Developer Details

License

MIT

Author version

v1.0

Skillstore revision

r1

Version notice

The author-declared version is not valid SemVer.

Ref

3f6e026a3363e0954ede7bef0cfe88d4475de137

Maintenance freshness

7/22/2026

Usage

1 downloads ยท 0 views

File structure

๐Ÿ“„ SKILL.md

More from internet-court

View all
View all