📦
Audit History
fulfill-git-escrow - 2 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 2 Latest
Jul 21, 2026, 02:59 AM
The skill legitimately automates Git escrow fulfillment, but it invokes third-party CLI commands, handles a blockchain private key, and clones external repositories. Several scanner hits are Markdown or metadata false positives. Publication requires safeguards for credential handling, repository trust, broad staging, and financial actions.
1
Files scanned
122
Lines analyzed
17
Review items
0
False positives ignored
Confirmed security concerns (4)
High
Environment file access
compatibility: Requires git-escrows CLI, git, a configured .env with PRIVATE_KEY, and network access
The documented .env configuration includes a PRIVATE_KEY, which is a sensitive credential used by the workflow.
High
Environment file access
Check if a `.env` file exists in the current directory. If not, tell the user they need one and sugg
The skill directs an agent to inspect whether a local .env file exists. Although content disclosure is not requested, it touches a sensitive configuration boundary.
High
Crypto seed/private key mention
git-escrows new-client --privateKey "0x..." --network "sepolia"
The example accepts a blockchain private key as a CLI argument. Command-line arguments may be exposed through shell history or process listings.
High
Unconfirmed financial submission
The workflow submits fulfillment data to an escrow system and later claims a token reward without requiring an explicit confirmation immediately before the state-changing action.
The documented fulfill and collect commands act on an escrow and reward workflow. The skill does not require a final user confirmation before those commands.
Capability review items (9)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
2. Clone it to a temporary location: `git clone <url> /tmp/escrow-tests-<uid> && cd /tmp/escrow-test
The skill clones and checks out a repository URL and commit obtained from escrow data. Untrusted repository content is introduced into a local temporary directory.
High
Ruby/shell backtick execution
1. Stage and commit the solution: `git add -A && git commit -m "solution for escrow <uid>"`
git add -A stages every working-tree change before committing. It can unintentionally include credentials or unrelated files.
High
Generic API/secret keys
compatibility: Requires git-escrows CLI, git, a configured .env with PRIVATE_KEY, and network access
The skill requires a PRIVATE_KEY in a .env file for its signing workflow. A private key is highly sensitive.
High
Generic API/secret keys
primaryEnv: PRIVATE_KEY
The metadata explicitly declares PRIVATE_KEY as the primary environment value. This exposes a sensitive signing credential to the invoked workflow.
Medium
Ruby/shell backtick execution
Run `git-escrows --help` to verify the CLI is installed. If it fails, try `npx git-escrows --help` o
The skill instructs execution of a CLI and fallback package runners. These may install or execute third-party package code.
Medium
Ruby/shell backtick execution
Run `git-escrows list --verbose --format json` and find the escrow matching the provided UID. Confir
The instruction executes a third-party CLI that queries escrow details and can access the configured signing environment.
Medium
Ruby/shell backtick execution
If no escrow UID was provided, ask the user for one. You can help them browse with `git-escrows list
The instruction runs the escrow CLI to retrieve remote escrow data. This is an external command with network-facing behavior.
Medium
Ruby/shell backtick execution
- Suggest checking status with: `git-escrows list --verbose`
The instruction runs the third-party escrow CLI to query status. It is legitimate functionality but performs an external command.
Medium
Temp directory access
2. Clone it to a temporary location: `git clone <url> /tmp/escrow-tests-<uid> && cd /tmp/escrow-test
A repository is cloned into a predictable temporary path. This persists untrusted content locally and can collide with an existing path.
Risk Factors
⚙️ External commands (22)
SKILL.md:26 SKILL.md:30 SKILL.md:37 SKILL.md:41 SKILL.md:42-44 SKILL.md:44-48 SKILL.md:48-52 SKILL.md:52-60 SKILL.md:60-71 SKILL.md:71-77 SKILL.md:77-78 SKILL.md:78-79 SKILL.md:79-84 SKILL.md:84-89 SKILL.md:89-96 SKILL.md:96-97 SKILL.md:97-103 SKILL.md:103-108 SKILL.md:108-116 SKILL.md:116-118 SKILL.md:118-119 SKILL.md:119-121
🌐 Network access (1)
📁 Filesystem access (1)
🔑 Env variables (2)
Audited by: claude
Jul 10, 2026, 12:06 AM
The skill legitimately centers on shell and git-escrows CLI usage. Several markdown backtick hits are false positives, but command execution, escrow network operations, and secret handling are confirmed. The largest risks are PRIVATE_KEY-backed .env use, CLI private-key setup, and blockchain escrow actions without explicit confirmation. No prompt injection attempt was found in SKILL.md.
1
Files scanned
122
Lines analyzed
24
Review items
0
False positives ignored
Confirmed security concerns (7)
High
Environment file access
compatibility: Requires git-escrows CLI, git, a configured .env with PRIVATE_KEY, and network access
The skill states that a configured .env with PRIVATE_KEY is required. This is sensitive environment-file dependency tied to a crypto key.
High
Environment file access
- .env
The metadata lists .env as required configuration. That file is expected to hold PRIVATE_KEY based on nearby metadata, so it is sensitive.
High
Environment file access
## Step 2: Check .env configuration
The section begins an explicit .env configuration check. The nearby steps make clear that this environment file relates to private-key setup.
High
Environment file access
Check if a `.env` file exists in the current directory. If not, tell the user they need one and sugg
The skill tells the agent to check whether a .env file exists in the current directory. Accessing or validating secret configuration files is sensitive in this workflow.
High
Crypto seed/private key mention
git-escrows new-client --privateKey "0x..." --network "sepolia"
The example command includes a privateKey argument. Even as a placeholder, it encourages command-line handling of a crypto private key, which can leak through local process or shell records.
High
Blockchain Transaction Without Explicit Confirmation
The workflow instructs the agent to run fulfill and collect commands. These actions may sign or submit escrow actions through a PRIVATE_KEY-backed CLI without final user approval.
The skill directly provides fulfill and collect command flows and separately declares PRIVATE_KEY as required. No line requires explicit user confirmation before those transaction-like actions.
High
Broad Git Staging May Publish Unrelated Files
The workflow tells the agent to work in the current directory and stage all changes before committing. This can include unrelated files or secrets in the submitted solution repository.
The instructions explicitly combine current-directory edits with git add -A and then use the repo URL for fulfillment. This creates a clear accidental disclosure path.
Capability review items (13)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution · 4 occurrences
```
The fenced example suggests running git-escrows new-client with a private key argument. Passing a crypto private key through CLI arguments can expose it through shell history or process metadata.
High
Ruby/shell backtick execution
2. Clone it to a temporary location: `git clone <url> /tmp/escrow-tests-<uid> && cd /tmp/escrow-test
The command clones an escrow-provided repository URL and checks out a supplied commit using a shell command chain. This creates risk from untrusted repositories and unsafely substituted placeholders.
High
Ruby/shell backtick execution
1. Stage and commit the solution: `git add -A && git commit -m "solution for escrow <uid>"`
The skill instructs git add -A and git commit in the current workspace. Broad staging can include unrelated or sensitive files before submission.
High
Generic API/secret keys
compatibility: Requires git-escrows CLI, git, a configured .env with PRIVATE_KEY, and network access
The compatibility metadata explicitly requires a .env file containing PRIVATE_KEY. A crypto private key is highly sensitive and can authorize transactions.
High
Generic API/secret keys
primaryEnv: PRIVATE_KEY
The metadata declares PRIVATE_KEY as the primary environment variable. This confirms the workflow depends on a secret that must be protected.
Medium
Ruby/shell backtick execution
Run `git-escrows --help` to verify the CLI is installed. If it fails, try `npx git-escrows --help` o
The skill tells the agent to run git-escrows, npx, or bunx commands. This is legitimate setup checking, but it executes external tooling and may fetch packages.
Medium
Ruby/shell backtick execution
Run `git-escrows list --verbose --format json` and find the escrow matching the provided UID. Confir
The skill instructs the agent to run git-escrows list with verbose JSON output. This is expected behavior, but it invokes a networked external CLI.
Medium
Ruby/shell backtick execution
If no escrow UID was provided, ask the user for one. You can help them browse with `git-escrows list
The skill suggests browsing open escrows with git-escrows list. This is a real external command and may contact the configured escrow network.
Medium
Ruby/shell backtick execution
- Suggest checking status with: `git-escrows list --verbose`
The skill suggests running git-escrows list --verbose to check status. This is an external CLI call that may use network and configured credentials.
Medium
Temp directory access
2. Clone it to a temporary location: `git clone <url> /tmp/escrow-tests-<uid> && cd /tmp/escrow-test
The skill instructs cloning into a predictable /tmp path derived from the escrow UID. This can collide with existing paths and exposes work to normal temporary-directory risks.
Risk Factors
⚙️ External commands (22)
SKILL.md:26 SKILL.md:30 SKILL.md:37 SKILL.md:41 SKILL.md:42-44 SKILL.md:44-48 SKILL.md:48-52 SKILL.md:52-60 SKILL.md:60-71 SKILL.md:71-77 SKILL.md:77-78 SKILL.md:78-79 SKILL.md:79-84 SKILL.md:84-89 SKILL.md:89-96 SKILL.md:96-97 SKILL.md:97-103 SKILL.md:103-108 SKILL.md:108-116 SKILL.md:116-118 SKILL.md:118-119 SKILL.md:119-121
🌐 Network access (1)
📁 Filesystem access (1)
🔑 Env variables (2)
Audited by: codex