Versioned security assessment

Report ID: SA-3F6E026A

7/19/2026, 10:11:00 AM

AgentLink Skill security assessment v2

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
AgentLink Skill
Version
v2
Maintainer
internet-court
Source
github.com/internet-court/internet-court-skill/tree/main/vendored/humanode/humanode-agentlink
Coverage
1 Files scanned · 181 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

7 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The Markdown backtick and reconnaissance alerts are false positives. Genuine risks include raw wallet-key handling, unpinned npm execution, signed third-party requests, and an endpoint advertising coordinated X activity.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Attestation unavailable

No public attestation is available for this report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 181 Lines analyzed

19 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 13 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Observed in 2 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 38 evidence locations

Capability review items (12)
High
SKILL.md:93
Generic API/secret keys
privateKey: process.env.AGENT_PRIVATE_KEY as `0x${string}`,
A raw wallet private key is passed from the environment into a third-party SDK. Compromise could enable unauthorized signatures and wallet actions.
High
SKILL.md:126
Generic API/secret keys
privateKey: process.env.AGENT_PRIVATE_KEY as `0x${string}`,
The SDK receives the raw private key to build authentication headers. Dependency or process compromise could expose the signing credential.
Low
SKILL.md:111
Hardcoded URL
const response = await agentFetch('https://api.xona-agent.com/base-main/image/nano-banana', {
The example sends a signed HTTPS POST to an external XONA service. This exposes authentication metadata and request content to that operator.
Low
SKILL.md:143
Hardcoded URL
agentlink request https://api.xona-agent.com/base-main/image/nano-banana --network base
The CLI command sends a signed agentlink header to the external XONA domain. Users must trust that service with authentication metadata.
Low
SKILL.md:158
Hardcoded URL
| `POST https://api.xona-agent.com/base-main/video/short-generation` | Generate a short video from a
The skill advertises an external XONA video endpoint that receives signed requests and user prompts. That creates a third-party trust boundary.
Low
SKILL.md:159
Hardcoded URL
| `POST https://api.xona-agent.com/base-main/image/nano-banana` | Generate an image from a text prom
The external XONA image endpoint receives signed authentication and prompt data. Its operation depends on an unaudited third party.
Low
SKILL.md:169
Hardcoded URL
| `GET https://wurkapi.fun/base/agentlink/xraid/xverified/small` | Commission an X (Twitter) raid |
The skill advertises a WURK endpoint for commissioning X activity. Use sends authentication to an external operator.
Low
SKILL.md:170
Hardcoded URL
| `GET https://wurkapi.fun/base/agentlink/agenttohuman` | Commission an agent-to-human job |
The agent-to-human job endpoint is operated by an external WURK domain. Signed use creates an explicit third-party trust boundary.
Low
SKILL.md:93
Environment variable access (dot notation)
privateKey: process.env.AGENT_PRIVATE_KEY as `0x${string}`,
The example reads AGENT_PRIVATE_KEY from the process environment. This is intentional credential access with meaningful exposure if dependencies or logs are compromised.
Low
SKILL.md:126
Environment variable access (dot notation)
privateKey: process.env.AGENT_PRIVATE_KEY as `0x${string}`,
The header-building example reads the wallet private key from process.env. Any code in the process can potentially access the same secret.
Low
SKILL.md:93
Environment variable object
privateKey: process.env.AGENT_PRIVATE_KEY as `0x${string}`,
The code directly accesses the process environment to obtain a signing key. The operation is legitimate but security-sensitive.
Low
SKILL.md:126
Environment variable object
privateKey: process.env.AGENT_PRIVATE_KEY as `0x${string}`,
The code directly accesses process.env for a wallet credential. This creates real secret-exposure risk within the application process.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (7)

RISK-001 High
SKILL.md:26
Crypto seed/private key mention
Run the CLI with `npx` (no global install needed) and store your agent private key. No on-chain writ
The workflow asks users to store an agent private key through an npm CLI. Package or host compromise could disclose a wallet signing credential.
RISK-002 High
SKILL.md:29
Crypto seed/private key mention
# Store the agent private key in the encrypted local keystore.
The CLI receives a private key before placing it in an encrypted keystore. Security depends on the package and local host remaining trustworthy.
RISK-003 High
SKILL.md:86
Crypto seed/private key mention
**Option A — raw private key.** Simplest for a self-hosted agent that keeps its key in an environmen
The guide explicitly offers a raw private-key integration. Exposure would allow unauthorized request signatures and potentially wallet operations.
RISK-004 High
SKILL.md:93
Crypto seed/private key mention
privateKey: process.env.AGENT_PRIVATE_KEY as `0x${string}`,
The example passes a raw wallet private key into SDK code. This is a genuine high-impact secret-handling operation.
RISK-005 High
SKILL.md:126
Crypto seed/private key mention
privateKey: process.env.AGENT_PRIVATE_KEY as `0x${string}`,
The header builder receives the raw wallet private key. Dependency compromise or accidental logging could expose it.
RISK-006 High
SKILL.md:26-37SKILL.md:78-93
Unpinned Package Handles Wallet Private Key
The guide runs unpinned npm packages and supplies an agent private key to them. A compromised release could steal the key.
The documented npx and npm commands omit versions, and the same workflow gives the installed software a wallet private key.
RISK-007 Medium
SKILL.md:163-170
Coordinated Social Platform Activity
The advertised WURK endpoint can commission an X raid. This can enable coordinated platform manipulation without consent controls.
The skill explicitly describes the endpoint as commissioning an X raid, and no safeguards or consent requirements are stated.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Unpinned npm packages execute while the workflow handles an agent private key.
    Pin exact package versions, publish integrity hashes, and verify package provenance before any private-key input.
  2. FIX-002
    High
    Examples pass a raw wallet private key from the environment into the SDK.
    Make external signers the default and isolate raw keys from application dependencies, logs, and child processes.
  3. FIX-003
    Medium
    Signed authentication payloads are sent to third-party partner domains.
    Require explicit domain approval, document partner trust boundaries, and restrict signed requests to an allowlist.
  4. FIX-004
    Medium
    The WURK integration advertises commissioning an X raid.
    Remove this endpoint or add consent, acceptable-use, rate-limit, and abuse-reporting controls.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
3f6e026a3363e0954ede7bef0cfe88d4475de137
Content hash
209b60b19eae16ac3666a573e3b30d94c2c1ed21a6c271e87f6f2cda6efbcf10
Tree hash
b964578bad067a4d4a06ac89cd69e24ab8f9dc14e8b2e45d5a7a3e1baea29479
Skill path
skills/internet-court/humanode-agentlink
Audit payload hash
2caf782fe460af658dd6aefd8c4453ee

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: unavailable