📦
Audit History
internet-court - 2 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 2 Latest
Jul 19, 2026, 10:16 AM
The bundle contains confirmed critical remote installer pipelines, secret-retrieval commands, model-generated eval, plaintext private-key workflows, and silent global plugin installation. Many remaining matches are lexical false positives, but the confirmed supply-chain and credential risks prevent unattended use. Static review was capped at 400/6908 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
376
Files scanned
59,995
Lines analyzed
85
Review items
0
False positives ignored
Confirmed security concerns (28)
Critical
Pipe to shell pattern
curl -L https://foundry.paradigm.xyz | bash
The guide pipes an unpinned remote response directly into a shell. A compromised server or redirected download would execute arbitrary code.
Critical
Pipe to shell pattern
- `cast` from Foundry (`curl -L https://foundry.paradigm.xyz | bash && foundryup`)
The guide pipes an unpinned remote response directly into a shell. A compromised server or redirected download would execute arbitrary code.
Critical
Pipe to shell pattern
curl -fsSL https://tempo.xyz/install | bash
The guide pipes an unpinned remote response directly into a shell. A compromised server or redirected download would execute arbitrary code.
Critical
Pipe to shell pattern
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
The guide pipes an unpinned remote response directly into a shell. A compromised server or redirected download would execute arbitrary code.
Critical
Pipe to shell pattern
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/cargo-near/releases/latest/download/ca
The guide pipes an unpinned remote response directly into a shell. A compromised server or redirected download would execute arbitrary code.
Critical
Pipe to shell pattern
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/near-cli-rs/releases/latest/download/n
The guide pipes an unpinned remote response directly into a shell. A compromised server or redirected download would execute arbitrary code.
Critical
macOS security command
> **Back up the passphrase either way.** Keychain entry: `service=chaingpt-mcp-agent-wallet account=
The command retrieves a wallet passphrase from macOS Keychain and prints it. Agent context, terminal capture, or logs could expose the secret.
Critical
Silent Third-Party Skill Installation
The routing skill silently installs a global third-party plugin and immediately loads its instructions. This bypasses informed consent and creates a supply-chain execution path.
The instructions explicitly use a global install command with automatic confirmation, call the process invisible, and immediately apply the installed plugin.
High
Certificate/key files
- Treat `ANTSEED_IDENTITY_HEX` / `~/.antseed/identity.key` as a hot wallet key.
The guide identifies a raw EVM private-key file used by a funded hot wallet. Disclosure, weak permissions, or unsafe backup would compromise funds.
High
Certificate/key files
| `identity.key` | Raw 32-byte EVM private key for the buyer wallet. Fallback when `ANTSEED_IDENTITY
The guide identifies a raw EVM private-key file used by a funded hot wallet. Disclosure, weak permissions, or unsafe backup would compromise funds.
High
Crypto seed/private key mention
- The page generates a real agent EOA for the demo and exports a JSON package containing the agent p
The demo exports or offers to export a real agent private key in a JSON bearer package. Disclosure would grant signing authority and access to funds.
High
Crypto seed/private key mention
The exported agent package is a bearer capability in demo form. Include explicit warnings, keep caps
The demo exports or offers to export a real agent private key in a JSON bearer package. Disclosure would grant signing authority and access to funds.
High
Crypto seed/private key mention
- include private key in exported JSON or omit it;
The demo exports or offers to export a real agent private key in a JSON bearer package. Disclosure would grant signing authority and access to funds.
High
Crypto seed/private key mention
# Login with wallet private key
The workflow asks the user to enter a wallet private key into a third-party CLI. A compromised CLI or captured terminal could steal it.
High
Crypto seed/private key mention
# Enter private key when prompted
The workflow asks the user to enter a wallet private key into a third-party CLI. A compromised CLI or captured terminal could steal it.
High
Crypto seed/private key mention
2. **Environment configuration**: Setup `.env` file with private key
The example stores a wallet private key in a plaintext environment file. File disclosure or accidental source control inclusion could compromise funds.
High
Crypto seed/private key mention
# Your wallet private key
The example stores a wallet private key in a plaintext environment file. File disclosure or accidental source control inclusion could compromise funds.
High
Crypto seed/private key mention
# Your wallet private key (NEVER commit this file!)
The example stores a wallet private key in a plaintext environment file. File disclosure or accidental source control inclusion could compromise funds.
High
Crypto seed/private key mention
# Your wallet private key
The example stores a wallet private key in a plaintext environment file. File disclosure or accidental source control inclusion could compromise funds.
High
Environment file access
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The example loads a wallet private key from a plaintext environment file or process environment. Secret exposure would permit unauthorized signing.
High
Environment file access
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The example loads a wallet private key from a plaintext environment file or process environment. Secret exposure would permit unauthorized signing.
High
Environment file access
2. **Environment configuration**: Setup `.env` file with private key
The example loads a wallet private key from a plaintext environment file or process environment. Secret exposure would permit unauthorized signing.
High
Environment file access
Create `.env`:
The example loads a wallet private key from a plaintext environment file or process environment. Secret exposure would permit unauthorized signing.
High
Environment file access
if (!process.env.PRIVATE_KEY) {
The example loads a wallet private key from a plaintext environment file or process environment. Secret exposure would permit unauthorized signing.
High
Automatic External Disclosure of User Context
The skill requires opening a public repository issue and including the user goal and failure details. It does not require user approval or redaction.
The instructions mandate filing the issue directly when a GitHub tool exists and specify that user goals and failures must be included.
High
Untrusted Peer Message Controls Priority Actions
A peer-controlled marker receives highest priority and causes raw message data to be written and passed to a CLI. Sender and job validation are not required.
The routing table explicitly prioritizes a peer marker before other actions and passes the complete untrusted message through a local file to the CLI.
Medium
SQLite database file
| `metering.db` | SQLite log of every request the proxy served (model, peer, tokens, USDC). Used by
The local database retains request, peer, token, and payment history. Backups or weak file permissions could expose operational metadata.
Medium
Untrusted Repository Content Lacks an Instruction Boundary
The workflow clones an escrow-selected repository and directs the agent to read its tests. It does not warn that repository instructions are untrusted data.
The repository URL and commit come from external escrow data, then the agent reads test content without a prompt-injection or trust-boundary safeguard.
Capability review items (52)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Dynamic code evaluation with eval()
LLMs can't reliably inspect characters in their input (they hallucinate em dashes, miscount characte
The guide generates Python expressions with an LLM and executes them through eval. Restricted builtins reduce risk but do not make model output trusted.
High
Dynamic code evaluation with eval()
# Step 2: eval() all checks in one sandbox — deterministic, no hallucination
The guide generates Python expressions with an LLM and executes them through eval. Restricted builtins reduce risk but do not make model output trusted.
High
Dynamic code evaluation with eval()
ok = eval(c["expression"], {
The guide generates Python expressions with an LLM and executes them through eval. Restricted builtins reduce risk but do not make model output trusted.
High
vendored/0g/0g-compute/references/account-management.md:222vendored/0g/0g-compute/references/account-management.md:569
Generic API/secret keys · 2 occurrences
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The example reads a wallet private key from environment variables and uses it for signing. Environment disclosure could lead to unauthorized transactions.
High
vendored/0g/0g-compute/references/examples/speech-to-text.md:117vendored/0g/0g-compute/references/examples/streaming-chat.md:116vendored/0g/0g-compute/references/examples/streaming-chat.md:578
Generic API/secret keys · 3 occurrences
PRIVATE_KEY=your_private_key_here
The example reads a wallet private key from environment variables and uses it for signing. Environment disclosure could lead to unauthorized transactions.
High
vendored/0g/0g-compute/references/examples/speech-to-text.md:274vendored/0g/0g-compute/references/examples/streaming-chat.md:189
Generic API/secret keys · 2 occurrences
if (!process.env.PRIVATE_KEY) {
The example reads a wallet private key from environment variables and uses it for signing. Environment disclosure could lead to unauthorized transactions.
High
Generic API/secret keys
throw new Error("PRIVATE_KEY not found in .env");
The example reads a wallet private key from environment variables and uses it for signing. Environment disclosure could lead to unauthorized transactions.
High
vendored/0g/0g-compute/references/examples/speech-to-text.md:311vendored/0g/0g-compute/references/examples/streaming-chat.md:201
Generic API/secret keys · 2 occurrences
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY, provider);
The example reads a wallet private key from environment variables and uses it for signing. Environment disclosure could lead to unauthorized transactions.
High
Generic API/secret keys
throw new Error("PRIVATE_KEY not found in environment variables");
The example reads a wallet private key from environment variables and uses it for signing. Environment disclosure could lead to unauthorized transactions.
High
Generic API/secret keys
#### "PRIVATE_KEY not found"
The example reads a wallet private key from environment variables and uses it for signing. Environment disclosure could lead to unauthorized transactions.
High
Hidden file in home directory
- Save the resulting session to `~/.altllm/portal-cli-session.json` unless overridden.
The guide persists an authenticated session under the home directory. Weak permissions, backups, or unintended reads could expose reusable credentials.
High
Hidden file in home directory
- Treat `ANTSEED_IDENTITY_HEX` / `~/.antseed/identity.key` as a hot wallet key.
The cited hidden file is a raw funded-wallet private key. Local disclosure or unsafe backup would permit unauthorized signing.
High
sudo privilege escalation
sudo systemctl restart hermes
The guide directs the agent to restart a system service with sudo. This privileged and disruptive operation requires explicit user approval.
High
sudo privilege escalation
> Or whatever supervisor you use. Then check the journal: `sudo journalctl -u hermes --no-pager -n 3
The guide invokes sudo to read service logs, which may expose sensitive runtime data. Elevated access should require explicit user approval.
High
sudo privilege escalation
- *Want to swap the routed model without restarting AntSeed* — Edit `model.default` (and `models:` i
The guide directs the agent to restart a system service with sudo. This privileged and disruptive operation requires explicit user approval.
Medium
vendored/altlayer/altllm-portal-auth/references/cli-reference.md:20vendored/altlayer/altllm-portal-auth/references/cli-reference.md:113
Hidden file access · 2 occurrences
"sessionFile": "/Users/<user>/.altllm/portal-cli-session.json",
The configuration points to a persisted authenticated session file. Weak file permissions or unintended reads could expose reusable credentials.
Medium
Hidden file access
- Save the resulting session to `~/.altllm/portal-cli-session.json` unless overridden.
The guide persists an authenticated session in a hidden home directory. Weak file permissions or backups could expose reusable credentials.
Medium
Hidden file access
- Treat `ANTSEED_IDENTITY_HEX` / `~/.antseed/identity.key` as a hot wallet key.
The cited hidden file contains a raw funded-wallet private key. Unintended local access would permit unauthorized signing.
Medium
Shell command substitution
export ANTSEED_IDENTITY_HEX=$(openssl rand -hex 32)
The command creates a raw wallet key and exports it into the process environment. Child processes or environment capture could expose it.
Medium
Shell command substitution
WALLET=$(cast wallet address --private-key "$PRIVATE_KEY")
The command expands a wallet private key into a process argument. Process inspection, debugging output, or shell tracing could expose the secret.
Medium
Shell command substitution
SIG=$(cast wallet sign --data --from-file --private-key "$PRIVATE_KEY" /tmp/eip712.json)
The command expands a wallet private key into a process argument. Process inspection, debugging output, or shell tracing could expose the secret.
Medium
Temp directory access
2. Clone it to a temporary location: `git clone <url> /tmp/escrow-tests-<uid> && cd /tmp/escrow-test
The guide clones an externally supplied repository into a predictable temporary path. Existing paths, symlinks, or crafted identifiers could redirect writes.
Medium
Temp directory access
cat > /tmp/eip712.json << EOF
The payment flow writes or reads a fixed temporary filename. Another local process could replace it through a symlink or race.
Medium
Temp directory access
SIG=$(cast wallet sign --data --from-file --private-key "$PRIVATE_KEY" /tmp/eip712.json)
The payment flow writes or reads a fixed temporary filename. Another local process could replace it through a symlink or race.
Medium
Temp directory access
| 1 | Contains `[intent:deliver]` | **Highest priority — process THIS TURN before any other CLI call
The workflow stores untrusted peer JSON in a predictable path derived from a job identifier. Missing validation creates overwrite and symlink risks.
Medium
Temp directory access
1. Write its **raw JSON** to `/tmp/a2a_deliver_<jobId>.json` first.
The workflow stores untrusted peer JSON in a predictable path derived from a job identifier. Missing validation creates overwrite and symlink risks.
Medium
xargs command (can execute arbitrary commands)
lsof -ti:7378 | xargs kill -9
The command force-kills every process listening on a port without checking ownership or identity. It can terminate an unrelated process.
Medium
Fetch API call
const response = await fetch(url);
The example fetches an unvalidated image URL without host or size limits. A malicious provider response could cause SSRF or resource exhaustion.
Medium
Fetch API call
const response = await fetch(imageUrl);
The example fetches an unvalidated image URL without host or size limits. A malicious provider response could cause SSRF or resource exhaustion.
Low
vendored/0g/0g-compute/references/examples/speech-to-text.md:141vendored/0g/0g-compute/references/examples/streaming-chat.md:141vendored/0g/0g-compute/references/examples/text-to-image.md:136
dotenv library · 3 occurrences
dotenv.config();
The example loads all variables from a local environment file into the process. In these wallet workflows, that environment can include private keys.
Low
vendored/openserv/openserv-agent-sdk/examples/basic-agent.ts:9vendored/openserv/openserv-agent-sdk/examples/haiku-poet-agent.ts:9
dotenv library · 2 occurrences
import 'dotenv/config'
The example loads all variables from a local environment file into the process. In these wallet workflows, that environment can include private keys.
Low
Environment variable access (bracket notation)
for (const key of required) creds[key] = process.env[key];
The code reads named credentials or a wallet private key from the process environment. Environment compromise would expose signing or API authority.
Low
Environment variable access (bracket notation)
const value = process.env[name]?.trim();
The code reads named credentials or a wallet private key from the process environment. Environment compromise would expose signing or API authority.
Low
vendored/0g/0g-compute/references/account-management.md:222vendored/0g/0g-compute/references/account-management.md:569
Environment variable access (dot notation) · 2 occurrences
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The code accesses a wallet private key through the process environment. Secret exposure would enable unauthorized wallet operations.
Low
Environment variable access (dot notation)
if (!process.env.PRIVATE_KEY) {
The code accesses a wallet private key through the process environment. Secret exposure would enable unauthorized wallet operations.
Low
Environment variable access (dot notation)
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY, provider);
The code accesses a wallet private key through the process environment. Secret exposure would enable unauthorized wallet operations.
Low
vendored/0g/0g-compute/references/account-management.md:222vendored/0g/0g-compute/references/account-management.md:569
Environment variable object · 2 occurrences
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The code accesses a wallet private key through the process environment. Secret exposure would enable unauthorized wallet operations.
Low
Environment variable object
if (!process.env.PRIVATE_KEY) {
The code accesses a wallet private key through the process environment. Secret exposure would enable unauthorized wallet operations.
Low
Environment variable object
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY, provider);
The code accesses a wallet private key through the process environment. Secret exposure would enable unauthorized wallet operations.
Low
Python environment access
1. **Store API keys in environment variables** — never hardcode. Use `process.env.CHAINGPT_API_KEY`
The example reads an API credential from the process environment for authentication. Environment disclosure would expose access to the external service.
Low
Python environment access
'Authorization': f'Bearer {os.environ["NEAR_API_KEY"]}'
The example reads an API credential from the process environment for authentication. Environment disclosure would expose access to the external service.
Risk Factors
⚙️ External commands (50)
integrations/genlayer-erc7710-connector/SKILL.md:8 integrations/genlayer-erc7710-connector/SKILL.md:12-18 integrations/genlayer-erc7710-connector/SKILL.md:18-27 integrations/genlayer-erc7710-connector/SKILL.md:27 integrations/genlayer-erc7710-connector/SKILL.md:63-71 integrations/genlayer-erc7710-connector/SKILL.md:71-75 integrations/genlayer-erc7710-connector/SKILL.md:75-76 integrations/genlayer-erc7710-connector/SKILL.md:76-77 integrations/genlayer-erc7710-connector/SKILL.md:77 integrations/genlayer-erc7710-connector/SKILL.md:81-82 integrations/genlayer-erc7710-connector/SKILL.md:82 integrations/genlayer-erc7710-connector/SKILL.md:83 integrations/genlayer-erc7710-connector/SKILL.md:103-106 integrations/genlayer-erc7710-connector/SKILL.md:106-113 integrations/genlayer-erc7710-connector/SKILL.md:113-114 integrations/genlayer-erc7710-connector/SKILL.md:114-115 integrations/genlayer-erc7710-connector/SKILL.md:115-120 integrations/genlayer-erc7710-connector/SKILL.md:120-124 integrations/genlayer-erc7710-connector/SKILL.md:124-127 integrations/genlayer-erc7710-connector/SKILL.md:127-128 integrations/genlayer-erc7710-connector/SKILL.md:128-129 integrations/genlayer-erc7710-connector/SKILL.md:129-132 integrations/genlayer-erc7710-connector/SKILL.md:132-138 integrations/genlayer-erc7710-connector/SKILL.md:138-148 integrations/genlayer-erc7710-connector/SKILL.md:148-159 integrations/genlayer-erc7710-connector/SKILL.md:159-160 integrations/genlayer-erc7710-connector/SKILL.md:160-161 integrations/genlayer-erc7710-connector/SKILL.md:161-162 integrations/genlayer-erc7710-connector/SKILL.md:162 integrations/genlayer-erc7710-connector/SKILL.md:163-178 integrations/genlayer-erc7710-connector/SKILL.md:178-179 integrations/genlayer-erc7710-connector/SKILL.md:179-180 integrations/genlayer-erc7710-connector/SKILL.md:180-193 integrations/genlayer-erc7710-connector/SKILL.md:193-202 integrations/genlayer-intelligent-contracts/references/agent-supervisor-contract.md:40-41 integrations/genlayer-intelligent-contracts/references/agent-supervisor-contract.md:41-44 integrations/genlayer-intelligent-contracts/SKILL.md:12 integrations/genlayer-intelligent-contracts/SKILL.md:16-23 integrations/genlayer-intelligent-contracts/SKILL.md:23-36 integrations/genlayer-intelligent-contracts/SKILL.md:36 integrations/genlayer-intelligent-contracts/SKILL.md:38 integrations/genlayer-intelligent-contracts/SKILL.md:46-70 integrations/genlayer-intelligent-contracts/SKILL.md:70-74 integrations/genlayer-intelligent-contracts/SKILL.md:74-77 integrations/genlayer-intelligent-contracts/SKILL.md:77-79 integrations/genlayer-intelligent-contracts/SKILL.md:79-80 integrations/genlayer-intelligent-contracts/SKILL.md:80-81 integrations/genlayer-intelligent-contracts/SKILL.md:81-82 integrations/genlayer-intelligent-contracts/SKILL.md:82-83 integrations/genlayer-intelligent-contracts/SKILL.md:83-84
🌐 Network access (50)
integrations/genlayer-erc7710-connector/SKILL.md:8 integrations/genlayer-intelligent-contracts/SKILL.md:3 integrations/genlayer-intelligent-contracts/SKILL.md:12 README.md:135 README.md:148 README.md:158 README.md:177 SKILL.md:36 SKILL.md:47 SKILL.md:218 SKILL.md:363 skills-lock.json:138 skills-lock.json:257 skills-lock.json:280 skills-lock.json:711 vendored/0g/0g-compute/README.md:20 vendored/0g/0g-compute/README.md:23 vendored/0g/0g-compute/README.md:26 vendored/0g/0g-compute/references/account-management.md:218 vendored/0g/0g-compute/references/account-management.md:219 vendored/0g/0g-compute/references/account-management.md:568 vendored/0g/0g-compute/references/examples/speech-to-text.md:238 vendored/0g/0g-compute/references/examples/speech-to-text.md:114 vendored/0g/0g-compute/references/examples/speech-to-text.md:143 vendored/0g/0g-compute/references/examples/streaming-chat.md:277 vendored/0g/0g-compute/references/examples/streaming-chat.md:113 vendored/0g/0g-compute/references/examples/streaming-chat.md:144 vendored/0g/0g-compute/references/examples/streaming-chat.md:450 vendored/0g/0g-compute/references/examples/text-to-image.md:188 vendored/0g/0g-compute/references/examples/text-to-image.md:280 vendored/0g/0g-compute/references/examples/text-to-image.md:440 vendored/0g/0g-compute/references/examples/text-to-image.md:457 vendored/0g/0g-compute/references/examples/text-to-image.md:67 vendored/0g/0g-compute/references/examples/text-to-image.md:111 vendored/0g/0g-compute/references/examples/text-to-image.md:138 vendored/0g/0g-compute/references/examples/text-to-image.md:389 vendored/0g/0g-compute/references/inference.md:131 vendored/0g/0g-compute/references/inference.md:156 vendored/0g/0g-compute/references/inference.md:236 vendored/0g/0g-compute/references/inference.md:273 vendored/0g/0g-compute/references/inference.md:296 vendored/0g/0g-compute/references/inference.md:16 vendored/0g/0g-compute/references/inference.md:17 vendored/0g/0g-compute/SKILL.md:73 vendored/0g/0g-compute/SKILL.md:27 vendored/0g/0g-compute/SKILL.md:28 vendored/0g/0g-compute/SKILL.md:56 vendored/0g/0g-compute/SKILL.md:57 vendored/0g/0g-compute/SKILL.md:171 vendored/0g/0g-compute/SKILL.md:172
📁 Filesystem access (50)
integrations/genlayer-intelligent-contracts/SKILL.md:38 README.md:135 README.md:148 README.md:158 README.md:161 README.md:177 README.md:135 README.md:148 README.md:158 README.md:161 README.md:177 SKILL.md:42 SKILL.md:48 vendored/0g/0g-compute/README.md:11 vendored/0g/0g-compute/README.md:12 vendored/0g/0g-compute/README.md:13 vendored/0g/0g-compute/README.md:20 vendored/0g/0g-compute/README.md:23 vendored/0g/0g-compute/README.md:26 vendored/0g/0g-compute/README.md:11 vendored/0g/0g-compute/README.md:12 vendored/0g/0g-compute/README.md:13 vendored/0g/0g-compute/README.md:20 vendored/0g/0g-compute/README.md:23 vendored/0g/0g-compute/README.md:26 vendored/0g/0g-compute/references/examples/README.md:145 vendored/0g/0g-compute/references/examples/README.md:146 vendored/0g/0g-compute/references/examples/README.md:147 vendored/0g/0g-compute/references/examples/README.md:163 vendored/0g/0g-compute/references/examples/speech-to-text.md:299 vendored/0g/0g-compute/references/examples/speech-to-text.md:383 vendored/0g/0g-compute/references/examples/speech-to-text.md:672 vendored/0g/0g-compute/references/examples/speech-to-text.md:287 vendored/0g/0g-compute/references/examples/speech-to-text.md:298 vendored/0g/0g-compute/references/examples/speech-to-text.md:303 vendored/0g/0g-compute/references/examples/speech-to-text.md:383 vendored/0g/0g-compute/references/examples/speech-to-text.md:225 vendored/0g/0g-compute/references/examples/speech-to-text.md:528 vendored/0g/0g-compute/references/examples/speech-to-text.md:341 vendored/0g/0g-compute/references/examples/speech-to-text.md:676 vendored/0g/0g-compute/references/examples/streaming-chat.md:250 vendored/0g/0g-compute/references/examples/streaming-chat.md:273 vendored/0g/0g-compute/references/examples/streaming-chat.md:645 vendored/0g/0g-compute/references/examples/streaming-chat.md:646 vendored/0g/0g-compute/references/examples/text-to-image.md:194 vendored/0g/0g-compute/references/examples/text-to-image.md:228 vendored/0g/0g-compute/references/examples/text-to-image.md:325 vendored/0g/0g-compute/references/examples/text-to-image.md:442 vendored/0g/0g-compute/references/examples/text-to-image.md:446 vendored/0g/0g-compute/references/examples/text-to-image.md:227
🔑 Env variables (50)
vendored/0g/0g-compute/references/account-management.md:217 vendored/0g/0g-compute/references/account-management.md:222 vendored/0g/0g-compute/references/account-management.md:569 vendored/0g/0g-compute/references/account-management.md:217 vendored/0g/0g-compute/references/account-management.md:222 vendored/0g/0g-compute/references/account-management.md:569 vendored/0g/0g-compute/references/account-management.md:222 vendored/0g/0g-compute/references/account-management.md:569 vendored/0g/0g-compute/references/examples/speech-to-text.md:143 vendored/0g/0g-compute/references/examples/speech-to-text.md:144 vendored/0g/0g-compute/references/examples/speech-to-text.md:145 vendored/0g/0g-compute/references/examples/speech-to-text.md:149 vendored/0g/0g-compute/references/examples/speech-to-text.md:274 vendored/0g/0g-compute/references/examples/speech-to-text.md:311 vendored/0g/0g-compute/references/examples/speech-to-text.md:143 vendored/0g/0g-compute/references/examples/speech-to-text.md:144 vendored/0g/0g-compute/references/examples/speech-to-text.md:145 vendored/0g/0g-compute/references/examples/speech-to-text.md:149 vendored/0g/0g-compute/references/examples/speech-to-text.md:274 vendored/0g/0g-compute/references/examples/speech-to-text.md:311 vendored/0g/0g-compute/references/examples/speech-to-text.md:67 vendored/0g/0g-compute/references/examples/speech-to-text.md:136 vendored/0g/0g-compute/references/examples/speech-to-text.md:141 vendored/0g/0g-compute/references/examples/speech-to-text.md:117 vendored/0g/0g-compute/references/examples/speech-to-text.md:274 vendored/0g/0g-compute/references/examples/speech-to-text.md:275 vendored/0g/0g-compute/references/examples/speech-to-text.md:311 vendored/0g/0g-compute/references/examples/streaming-chat.md:144 vendored/0g/0g-compute/references/examples/streaming-chat.md:148 vendored/0g/0g-compute/references/examples/streaming-chat.md:149 vendored/0g/0g-compute/references/examples/streaming-chat.md:189 vendored/0g/0g-compute/references/examples/streaming-chat.md:201 vendored/0g/0g-compute/references/examples/streaming-chat.md:144 vendored/0g/0g-compute/references/examples/streaming-chat.md:148 vendored/0g/0g-compute/references/examples/streaming-chat.md:149 vendored/0g/0g-compute/references/examples/streaming-chat.md:189 vendored/0g/0g-compute/references/examples/streaming-chat.md:201 vendored/0g/0g-compute/references/examples/streaming-chat.md:66 vendored/0g/0g-compute/references/examples/streaming-chat.md:138 vendored/0g/0g-compute/references/examples/streaming-chat.md:141 vendored/0g/0g-compute/references/examples/streaming-chat.md:116 vendored/0g/0g-compute/references/examples/streaming-chat.md:189 vendored/0g/0g-compute/references/examples/streaming-chat.md:190 vendored/0g/0g-compute/references/examples/streaming-chat.md:201 vendored/0g/0g-compute/references/examples/streaming-chat.md:574 vendored/0g/0g-compute/references/examples/streaming-chat.md:578 vendored/0g/0g-compute/references/examples/text-to-image.md:138 vendored/0g/0g-compute/references/examples/text-to-image.md:139 vendored/0g/0g-compute/references/examples/text-to-image.md:143 vendored/0g/0g-compute/references/examples/text-to-image.md:203
⚡ Contains scripts (14)
vendored/arkhai/alkahest-developer/references/python-api.md:16-21 vendored/arkhai/alkahest-developer/references/python-api.md:183-192 vendored/arkhai/alkahest-developer/references/python-api.md:202-208 vendored/arkhai/alkahest-developer/references/python-api.md:235-241 vendored/genlayer/write-contract/SKILL.md:393 vendored/genlayer/write-contract/SKILL.md:407 vendored/genlayer/write-contract/SKILL.md:412 vendored/genlayer/write-contract/SKILL.md:178 vendored/kleros/kleros-ipfs-upload/SKILL.md:107 vendored/okx/okx-agent-payments-protocol/SKILL.md:180 vendored/openserv/openserv-agent-sdk/troubleshooting.md:175 vendored/openserv/openserv-agent-sdk/troubleshooting.md:179 vendored/openserv/openserv-agent-sdk/troubleshooting.md:180 vendored/openserv/openserv-agent-sdk/troubleshooting.md:186
Detected Patterns
Pipe to shell patternPipe to shell patternPipe to shell patternPipe to shell patternPipe to shell patternPipe to shell patternmacOS security command
Audited by: codex
Jul 10, 2026, 12:15 AM
Internet Court is high risk because it routes wallet custody, delegated authority, payments, escrow, and disputes across many vendored protocol skills. Confirmed issues include pipe-to-shell installers, private-key handling, environment secrets, privileged commands, eval, filesystem access, and network-loaded sub-skills. Manual review is required before publication or automatic installation. Static review was capped at 400/6831 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
379
Files scanned
59,919
Lines analyzed
162
Review items
0
False positives ignored
Confirmed security concerns (39)
Critical
Pipe to shell pattern
curl -L https://foundry.paradigm.xyz | bash
The finding pipes network-downloaded installer content directly into a shell. That is a real supply-chain execution risk without local review or checksum verification.
Critical
Pipe to shell pattern
- `cast` from Foundry (`curl -L https://foundry.paradigm.xyz | bash && foundryup`)
The finding pipes network-downloaded installer content directly into a shell. That is a real supply-chain execution risk without local review or checksum verification.
Critical
Pipe to shell pattern
curl -fsSL https://tempo.xyz/install | bash
The finding pipes network-downloaded installer content directly into a shell. That is a real supply-chain execution risk without local review or checksum verification.
Critical
Pipe to shell pattern
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
The finding pipes network-downloaded installer content directly into a shell. That is a real supply-chain execution risk without local review or checksum verification.
Critical
Pipe to shell pattern
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/cargo-near/releases/latest/download/ca
The finding pipes network-downloaded installer content directly into a shell. That is a real supply-chain execution risk without local review or checksum verification.
Critical
Pipe to shell pattern
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/near-cli-rs/releases/latest/download/n
The finding pipes network-downloaded installer content directly into a shell. That is a real supply-chain execution risk without local review or checksum verification.
Critical
1Password data
- **Recover lost passphrases.** Lose `CHAINGPT_AGENT_WALLET_PASSPHRASE` → the keystore is unrecovera
The text handles a wallet passphrase and keystore recovery boundary. It is legitimate guidance, but it is a real secret-handling surface where disclosure or loss can compromise funds.
Critical
Cryptocurrency wallet
if (typeof window.ethereum === "undefined") {
The snippet accesses a browser or server wallet interface capable of signing or sending transactions. Wallet access is a real funds-at-risk security surface.
Critical
Cryptocurrency wallet
const provider = new BrowserProvider(window.ethereum);
The snippet accesses a browser or server wallet interface capable of signing or sending transactions. Wallet access is a real funds-at-risk security surface.
Critical
Cryptocurrency wallet
transport: custom(window.ethereum),
The snippet accesses a browser or server wallet interface capable of signing or sending transactions. Wallet access is a real funds-at-risk security surface.
Critical
Cryptocurrency wallet
Available chain adapters: `evm.EVM`, `bitcoin.Bitcoin`, `solana.Solana`, `cosmos.Cosmos`, `xrp.XRP`,
The text describes cryptocurrency chain adapters in a signing context. It is not malicious by itself, but it confirms wallet-related authority is in scope.
Critical
Cryptocurrency wallet
- **Server-side:** Call `privy.wallets().ethereum().sendTransaction()` or equivalent
The snippet accesses a browser or server wallet interface capable of signing or sending transactions. Wallet access is a real funds-at-risk security surface.
Critical
macOS security command
> **Back up the passphrase either way.** Keychain entry: `service=chaingpt-mcp-agent-wallet account=
The text references storing or recovering a wallet passphrase through the macOS Keychain. This is a legitimate pattern but still exposes sensitive wallet custody material.
High
Certificate/key files
- Treat `ANTSEED_IDENTITY_HEX` / `~/.antseed/identity.key` as a hot wallet key.
The snippet identifies a wallet identity key or hot wallet secret. Losing or exposing this key can compromise funds or paid-service authority.
High
Certificate/key files
| `identity.key` | Raw 32-byte EVM private key for the buyer wallet. Fallback when `ANTSEED_IDENTITY
The snippet identifies a wallet identity key or hot wallet secret. Losing or exposing this key can compromise funds or paid-service authority.
High
Certificate/key files
| `identity.enc` | Encrypted copy of `identity.key` (when the desktop app sets a passphrase). | yes
The snippet identifies a wallet identity key or hot wallet secret. Losing or exposing this key can compromise funds or paid-service authority.
High
Crypto seed/private key mention
- The page generates a real agent EOA for the demo and exports a JSON package containing the agent p
The finding references wallet key material in a commerce workflow. Context appears legitimate, but it remains sensitive enough to keep for review.
High
Crypto seed/private key mention
The exported agent package is a bearer capability in demo form. Include explicit warnings, keep caps
The finding references wallet key material in a commerce workflow. Context appears legitimate, but it remains sensitive enough to keep for review.
High
Crypto seed/private key mention
- include private key in exported JSON or omit it;
The snippet involves generating, exporting, entering, or using wallet private-key material. That creates direct custody and funds-loss risk if mishandled.
High
Crypto seed/private key mention
| Give an agent a wallet with a built-in policy gate (per-tx caps, velocity limits, session keys) in
The finding references wallet key material in a commerce workflow. Context appears legitimate, but it remains sensitive enough to keep for review.
High
Crypto seed/private key mention
# Login with wallet private key
The snippet involves generating, exporting, entering, or using wallet private-key material. That creates direct custody and funds-loss risk if mishandled.
High
Crypto seed/private key mention
# Enter private key when prompted
The snippet involves generating, exporting, entering, or using wallet private-key material. That creates direct custody and funds-loss risk if mishandled.
High
Crypto seed/private key mention
2. **Environment configuration**: Setup `.env` file with private key
The snippet involves generating, exporting, entering, or using wallet private-key material. That creates direct custody and funds-loss risk if mishandled.
High
Crypto seed/private key mention
# Your wallet private key
The snippet involves generating, exporting, entering, or using wallet private-key material. That creates direct custody and funds-loss risk if mishandled.
High
Crypto seed/private key mention
# Your wallet private key
The snippet involves generating, exporting, entering, or using wallet private-key material. That creates direct custody and funds-loss risk if mishandled.
High
Crypto seed/private key mention
- Decrypts the key using your private key
The snippet involves generating, exporting, entering, or using wallet private-key material. That creates direct custody and funds-loss risk if mishandled.
High
Crypto seed/private key mention
- Ensure you're using the correct private key
The snippet involves generating, exporting, entering, or using wallet private-key material. That creates direct custody and funds-loss risk if mishandled.
High
Crypto seed/private key mention
### Private Key Safety
The snippet involves generating, exporting, entering, or using wallet private-key material. That creates direct custody and funds-loss risk if mishandled.
High
Environment file access
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The example stores or reads wallet private-key material from an environment file. Environment-backed wallet keys are a real secret-handling risk.
High
Environment file access
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The example stores or reads wallet private-key material from an environment file. Environment-backed wallet keys are a real secret-handling risk.
High
Environment file access
2. **Environment configuration**: Setup `.env` file with private key
The example stores or reads wallet private-key material from an environment file. Environment-backed wallet keys are a real secret-handling risk.
High
Environment file access
Create `.env`:
The example stores or reads wallet private-key material from an environment file. Environment-backed wallet keys are a real secret-handling risk.
High
Environment variant files
This deploys a **fresh factory contract** (writing the new address to `.env.local`), not a new oracl
The finding references an environment variant file. It may be benign configuration, but these files commonly store secrets and require manual review.
High
Environment variant files
# .env.local
The finding references an environment variant file. It may be benign configuration, but these files commonly store secrets and require manual review.
High
Dynamic Remote Skill Loading Bypasses Bundled Review
The master skill tells agents to fetch missing sibling skills from raw GitHub when only the root skill is installed. That can load network content outside the bundled audit unless fetched files are pinned and verified.
Lines 42-48 describe the root-only install path and raw GitHub fallback. This is an intent-level supply-chain risk beyond a simple hardcoded URL.
Medium
SQLite database file
| `metering.db` | SQLite log of every request the proxy served (model, peer, tokens, USDC). Used by
The file documents a SQLite log containing request, token, and USDC metering data. That is persistent operational and payment metadata.
Low
Unscanned file (invalid_frontmatter) — manual review required
[unscanned: invalid_frontmatter]
The file could not be statically scanned because of invalid frontmatter. Manual review is required before treating that vendored skill as safe.
Low
Unscanned file (invalid_frontmatter) — manual review required
[unscanned: invalid_frontmatter]
The file could not be statically scanned because of invalid frontmatter. Manual review is required before treating that vendored skill as safe.
Low
Unscanned file (invalid_frontmatter) — manual review required
[unscanned: invalid_frontmatter]
The file could not be statically scanned because of invalid frontmatter. Manual review is required before treating that vendored skill as safe.
Capability review items (118)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Dynamic code evaluation with eval()
LLMs can't reliably inspect characters in their input (they hallucinate em dashes, miscount characte
The file instructs eval() over expressions generated from natural language rules. Even with a restricted builtins dictionary, dynamic evaluation is a real code-execution risk.
High
Dynamic code evaluation with eval()
# Step 2: eval() all checks in one sandbox — deterministic, no hallucination
The file instructs eval() over expressions generated from natural language rules. Even with a restricted builtins dictionary, dynamic evaluation is a real code-execution risk.
High
Dynamic code evaluation with eval()
ok = eval(c["expression"], {
The file instructs eval() over expressions generated from natural language rules. Even with a restricted builtins dictionary, dynamic evaluation is a real code-execution risk.
High
vendored/0g/0g-compute/references/account-management.md:222vendored/0g/0g-compute/references/account-management.md:569
Generic API/secret keys · 2 occurrences
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The snippet reads or requires a wallet private key from the environment. This is a real secret and transaction-authority risk.
High
vendored/0g/0g-compute/references/examples/speech-to-text.md:117vendored/0g/0g-compute/references/examples/streaming-chat.md:116
Generic API/secret keys · 2 occurrences
PRIVATE_KEY=your_private_key_here
The snippet reads or requires a wallet private key from the environment. This is a real secret and transaction-authority risk.
High
vendored/0g/0g-compute/references/examples/speech-to-text.md:274vendored/0g/0g-compute/references/examples/streaming-chat.md:189
Generic API/secret keys · 2 occurrences
if (!process.env.PRIVATE_KEY) {
The snippet reads or requires a wallet private key from the environment. This is a real secret and transaction-authority risk.
High
Generic API/secret keys
throw new Error("PRIVATE_KEY not found in .env");
The snippet reads or requires a wallet private key from the environment. This is a real secret and transaction-authority risk.
High
vendored/0g/0g-compute/references/examples/speech-to-text.md:311vendored/0g/0g-compute/references/examples/streaming-chat.md:201
Generic API/secret keys · 2 occurrences
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY, provider);
The snippet reads or requires a wallet private key from the environment. This is a real secret and transaction-authority risk.
High
Generic API/secret keys
throw new Error("PRIVATE_KEY not found in environment variables");
The snippet reads or requires a wallet private key from the environment. This is a real secret and transaction-authority risk.
High
Generic API/secret keys
#### "PRIVATE_KEY not found"
The snippet reads or requires a wallet private key from the environment. This is a real secret and transaction-authority risk.
High
Git platform tokens
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
The workflow injects a GitHub platform token into the job environment. This is standard CI practice, but it is credential access with repository authority.
High
Hidden file in home directory
- Save the resulting session to `~/.altllm/portal-cli-session.json` unless overridden.
The hidden path stores an authenticated portal session. Session files can grant account access if copied or leaked.
High
Hidden file in home directory
`~/.antseed/buyer.state.json` and applies to every request until you change it.
The hidden AntSeed directory stores persistent payment and peer state. It may be operational rather than secret, but it affects paid-service behavior.
High
Hidden file in home directory
- Treat `ANTSEED_IDENTITY_HEX` / `~/.antseed/identity.key` as a hot wallet key.
The hidden path contains a wallet identity key or hot wallet material. This is sensitive custody data stored under the user home directory.
High
Hidden file in home directory
`~/.antseed/buyer.state.json` (`pinnedPeerId`) and applies to every request
The hidden AntSeed directory stores persistent payment and peer state. It may be operational rather than secret, but it affects paid-service behavior.
High
Hidden file in home directory
## Files the CLI creates in `~/.antseed/`
The hidden AntSeed directory stores persistent payment and peer state. It may be operational rather than secret, but it affects paid-service behavior.
High
sudo privilege escalation
sudo systemctl restart hermes
The snippet instructs use of sudo to restart or inspect a system service. Privileged service control can affect the host and must require explicit user approval.
High
sudo privilege escalation
> Or whatever supervisor you use. Then check the journal: `sudo journalctl -u hermes --no-pager -n 3
The snippet instructs use of sudo to restart or inspect a system service. Privileged service control can affect the host and must require explicit user approval.
High
sudo privilege escalation
- *Want to swap the routed model without restarting AntSeed* — Edit `model.default` (and `models:` i
The snippet instructs use of sudo to restart or inspect a system service. Privileged service control can affect the host and must require explicit user approval.
Medium
Dynamic import() expression
node -e "import('viem/accounts').then(m => console.log(m.generatePrivateKey()))"
The dynamic import appears in a one-line command that generates wallet key material. The import is controlled, but the surrounding operation is security-sensitive.
Medium
vendored/0g/0g-compute/references/examples/speech-to-text.md:225vendored/0g/0g-compute/references/examples/speech-to-text.md:528
File stream creation · 2 occurrences
const fileStream = fs.createReadStream(audioFilePath);
The example creates a file stream from a local path for upload or processing. This is legitimate, but user-controlled paths can expose unintended local files.
Medium
vendored/altlayer/altllm-portal-auth/references/cli-reference.md:20vendored/altlayer/altllm-portal-auth/references/cli-reference.md:113
Hidden file access · 2 occurrences
"sessionFile": "/Users/<user>/.altllm/portal-cli-session.json",
The hidden path stores an authenticated portal session. Session files can grant account access if copied or leaked.
Medium
Hidden file access
- Save the resulting session to `~/.altllm/portal-cli-session.json` unless overridden.
The hidden path stores an authenticated portal session. Session files can grant account access if copied or leaked.
Medium
Hidden file access
`~/.antseed/buyer.state.json` and applies to every request until you change it.
The hidden AntSeed directory stores persistent payment and peer state. It may be operational rather than secret, but it affects paid-service behavior.
Medium
Hidden file access
- Treat `ANTSEED_IDENTITY_HEX` / `~/.antseed/identity.key` as a hot wallet key.
The hidden path contains a wallet identity key or hot wallet material. This is sensitive custody data stored under the user home directory.
Medium
Node.js fs operations
fs.mkdirSync(TRANSCRIPT_DIR, { recursive: true });
The example performs local filesystem reads, writes, directory creation, or directory listing. Legitimate examples still require review for path safety.
Medium
Node.js fs operations
fs.writeFileSync(outputFile, outputContent);
The example performs local filesystem reads, writes, directory creation, or directory listing. Legitimate examples still require review for path safety.
Medium
Node.js fs operations
const audioFiles = fs.readdirSync(AUDIO_DIR)
The example performs local filesystem reads, writes, directory creation, or directory listing. Legitimate examples still require review for path safety.
Medium
vendored/0g/0g-compute/references/examples/text-to-image.md:194vendored/0g/0g-compute/references/examples/text-to-image.md:442
Node.js fs operations · 2 occurrences
fs.writeFileSync(filepath, Buffer.from(buffer));
The example performs local filesystem reads, writes, directory creation, or directory listing. Legitimate examples still require review for path safety.
Medium
Node.js fs operations
fs.mkdirSync(OUTPUT_DIR, { recursive: true });
The example performs local filesystem reads, writes, directory creation, or directory listing. Legitimate examples still require review for path safety.
Medium
vendored/0g/0g-compute/references/examples/text-to-image.md:325vendored/0g/0g-compute/references/examples/text-to-image.md:446
Node.js fs operations · 2 occurrences
fs.writeFileSync(filepath, Buffer.from(base64Data, "base64"));
The example performs local filesystem reads, writes, directory creation, or directory listing. Legitimate examples still require review for path safety.
Medium
Shell command substitution
PERMISSION=$(gh api repos/${{ github.repository }}/collaborators/$ACTOR/permission --jq '.permission
The workflow runs a GitHub CLI command and stores the result through shell substitution. It appears legitimate, but it exercises repository API access.
Medium
Shell command substitution
export ANTSEED_IDENTITY_HEX=$(openssl rand -hex 32)
The shell substitution is part of wallet key generation, signature creation, or payment-header construction. That is security-sensitive command execution.
Medium
Shell command substitution
WALLET=$(cast wallet address --private-key "$PRIVATE_KEY")
The shell substitution is part of wallet key generation, signature creation, or payment-header construction. That is security-sensitive command execution.
Medium
Shell command substitution
NONCE=0x$(openssl rand -hex 32)
The shell substitution is part of wallet key generation, signature creation, or payment-header construction. That is security-sensitive command execution.
Medium
Shell command substitution
SIG=$(cast wallet sign --data --from-file --private-key "$PRIVATE_KEY" /tmp/eip712.json)
The shell substitution is part of wallet key generation, signature creation, or payment-header construction. That is security-sensitive command execution.
Medium
Shell command substitution
X_PAYMENT=$(printf '{"x402Version":1,"scheme":"exact","network":"base","payload":{"signature":"%s","
The shell substitution is part of wallet key generation, signature creation, or payment-header construction. That is security-sensitive command execution.
Medium
Synchronous file operations
fs.writeFileSync(outputFile, outputContent);
The sample writes files synchronously to local paths. This is normal example code, but it can overwrite data if paths are user-controlled.
Medium
vendored/0g/0g-compute/references/examples/text-to-image.md:194vendored/0g/0g-compute/references/examples/text-to-image.md:442
Synchronous file operations · 2 occurrences
fs.writeFileSync(filepath, Buffer.from(buffer));
The sample writes files synchronously to local paths. This is normal example code, but it can overwrite data if paths are user-controlled.
Medium
vendored/0g/0g-compute/references/examples/text-to-image.md:325vendored/0g/0g-compute/references/examples/text-to-image.md:446
Synchronous file operations · 2 occurrences
fs.writeFileSync(filepath, Buffer.from(base64Data, "base64"));
The sample writes files synchronously to local paths. This is normal example code, but it can overwrite data if paths are user-controlled.
Medium
Temp directory access
2. Clone it to a temporary location: `git clone <url> /tmp/escrow-tests-<uid> && cd /tmp/escrow-test
The instruction clones a user-provided repository into /tmp and changes into it. That workflow can expose the agent to untrusted repository content.
Medium
Temp directory access
cat > /tmp/eip712.json << EOF
The temporary file path participates in signing or paid upload workflows. Temporary storage of wallet or evidence material needs review.
Medium
Temp directory access
SIG=$(cast wallet sign --data --from-file --private-key "$PRIVATE_KEY" /tmp/eip712.json)
The temporary file path participates in signing or paid upload workflows. Temporary storage of wallet or evidence material needs review.
Medium
Temp directory access
2. Run the bundled script: `EVM_PRIVATE_KEY=0x... npx tsx pay-and-upload.ts /tmp/exhibit-a.png`.
The temporary file path participates in signing or paid upload workflows. Temporary storage of wallet or evidence material needs review.
Medium
Temp directory access
1. Write its **raw JSON** to `/tmp/a2a_deliver_<jobId>.json` first.
The instruction writes raw agent-delivery JSON into /tmp. This may be operational, but temporary files can expose sensitive task data.
Medium
vendored/antseed/antseed-connect/SKILL.md:77-92vendored/okx/okx-dapp-discovery/SKILL.md:167-182vendored/okx/okx-dapp-discovery/SKILL.md:275-302
Template literal with command substitution · 3 occurrences
```bash
The bash block around this line generates a wallet identity key and configures paid-service access. The command block is security-sensitive.
Medium
xargs command (can execute arbitrary commands)
lsof -ti:7378 | xargs kill -9
The command pipes process ids into kill -9. It is a troubleshooting command, but it can terminate local processes and should require explicit approval.
Low
vendored/0g/0g-compute/references/examples/speech-to-text.md:136vendored/0g/0g-compute/references/examples/streaming-chat.md:138vendored/0g/0g-compute/references/examples/text-to-image.md:132
dotenv library · 3 occurrences
import * as dotenv from "dotenv";
The file imports dotenv for environment loading in credential-backed examples. The import alone is not dangerous, but it supports secret access.
Low
vendored/0g/0g-compute/references/examples/speech-to-text.md:141vendored/0g/0g-compute/references/examples/streaming-chat.md:141vendored/0g/0g-compute/references/examples/text-to-image.md:136
dotenv library · 3 occurrences
dotenv.config();
The code loads environment variables into the process. This is standard practice, but these examples also handle wallet or provider credentials.
Low
vendored/openserv/openserv-agent-sdk/examples/basic-agent.ts:9vendored/openserv/openserv-agent-sdk/examples/haiku-poet-agent.ts:9
dotenv library · 2 occurrences
import 'dotenv/config'
The code loads environment variables into the process. This is standard practice, but these examples also handle wallet or provider credentials.
Low
Environment variable access (bracket notation)
for (const key of required) creds[key] = process.env[key];
The code reads named credentials or account settings from process.env using bracket notation. The surrounding examples include API keys or wallet keys.
Low
Environment variable access (bracket notation)
const value = process.env[name]?.trim();
The code reads named credentials or account settings from process.env using bracket notation. The surrounding examples include API keys or wallet keys.
Low
vendored/0g/0g-compute/references/account-management.md:222vendored/0g/0g-compute/references/account-management.md:569
Environment variable access (dot notation) · 2 occurrences
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The code reads a wallet private key from process.env. This is direct access to sensitive transaction authority.
Low
Environment variable access (dot notation)
if (!process.env.PRIVATE_KEY) {
The code reads a wallet private key from process.env. This is direct access to sensitive transaction authority.
Low
Environment variable access (dot notation)
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY, provider);
The code reads a wallet private key from process.env. This is direct access to sensitive transaction authority.
Low
vendored/0g/0g-compute/references/account-management.md:222vendored/0g/0g-compute/references/account-management.md:569
Environment variable object · 2 occurrences
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The code reads a wallet private key from process.env. This is direct access to sensitive transaction authority.
Low
Environment variable object
if (!process.env.PRIVATE_KEY) {
The code reads a wallet private key from process.env. This is direct access to sensitive transaction authority.
Low
Environment variable object
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY, provider);
The code reads a wallet private key from process.env. This is direct access to sensitive transaction authority.
Low
Fetch API call
const response = await fetch(\`\${endpoint}/audio/transcriptions\`, {
The code sends requests to model or inference endpoints. Network calls are expected here but still expose prompts, files, or paid-service activity externally.
Low
Fetch API call
const response = await fetch(\`\${endpoint}/chat/completions\`, {
The code sends requests to model or inference endpoints. Network calls are expected here but still expose prompts, files, or paid-service activity externally.
Low
Fetch API call
const response = await fetch(url);
The code sends requests to model or inference endpoints. Network calls are expected here but still expose prompts, files, or paid-service activity externally.
Low
Fetch API call
const response = await fetch(\`\${endpoint}/images/generations\`, {
The code sends requests to model or inference endpoints. Network calls are expected here but still expose prompts, files, or paid-service activity externally.
Low
Fetch API call
const response = await fetch(imageUrl);
The code sends requests to model or inference endpoints. Network calls are expected here but still expose prompts, files, or paid-service activity externally.
Low
Fetch API call
const response = await fetch(...);
The code sends requests to model or inference endpoints. Network calls are expected here but still expose prompts, files, or paid-service activity externally.
Low
vendored/0g/0g-compute/references/inference.md:131vendored/0g/0g-compute/references/inference.md:156
Fetch API call · 2 occurrences
const response = await fetch(`${endpoint}/chat/completions`, {
The code sends requests to model or inference endpoints. Network calls are expected here but still expose prompts, files, or paid-service activity externally.
Low
Fetch API call
const response = await fetch(`${endpoint}/images/generations`, {
The code sends requests to model or inference endpoints. Network calls are expected here but still expose prompts, files, or paid-service activity externally.
Low
Fetch API call
const response = await fetch(`${endpoint}/audio/transcriptions`, {
The code sends requests to model or inference endpoints. Network calls are expected here but still expose prompts, files, or paid-service activity externally.
Low
Hardcoded URL
`https://raw.githubusercontent.com/internet-court/internet-court-skill/main/<path>`
The URL is a raw GitHub fallback for loading skill files. Fetching executable instructions from the network can bypass the bundled audit unless pinned and verified.
Low
Hardcoded URL
| Settle a narrow binary question from public web evidence (prediction market / factual oracle) | `v
The skill intentionally uses public web evidence or external oracle URLs. This is expected functionality but still a network dependency.
Low
Hardcoded URL
"source": "https://www.intelligentoracle.com/skill.md",
The skill intentionally uses public web evidence or external oracle URLs. This is expected functionality but still a network dependency.
Low
Hardcoded URL
? "https://evmrpc.0g.ai" // Mainnet
The URL points to an external blockchain RPC endpoint. This is expected but creates a network dependency and potential metadata exposure.
Low
Hardcoded URL
: "https://evmrpc-testnet.0g.ai"; // Testnet
The URL points to an external blockchain RPC endpoint. This is expected but creates a network dependency and potential metadata exposure.
Low
Hardcoded URL
const provider = new ethers.JsonRpcProvider("https://evmrpc-testnet.0g.ai");
The URL points to an external blockchain RPC endpoint. This is expected but creates a network dependency and potential metadata exposure.
Low
vendored/0g/0g-compute/references/examples/speech-to-text.md:114vendored/0g/0g-compute/references/examples/streaming-chat.md:113
Hardcoded URL · 2 occurrences
RPC_URL=https://evmrpc.0g.ai
The URL points to an external blockchain RPC endpoint. This is expected but creates a network dependency and potential metadata exposure.
Low
vendored/0g/0g-compute/references/examples/speech-to-text.md:143vendored/0g/0g-compute/references/examples/streaming-chat.md:144
Hardcoded URL · 2 occurrences
const RPC_URL = process.env.RPC_URL || "https://evmrpc.0g.ai";
The URL points to an external blockchain RPC endpoint. This is expected but creates a network dependency and potential metadata exposure.
Low
HTTP client library
"node-fetch": "^3.3.2"
The dependency or client setup enables outbound API calls. That is expected for the example but remains a network access risk factor.
Low
vendored/openserv/openserv-ideaboard-api/examples/browse-ideas.ts:12vendored/openserv/openserv-ideaboard-api/examples/get-api-key.ts:14vendored/openserv/openserv-ideaboard-api/examples/pick-up-and-ship.ts:15
HTTP client library · 3 occurrences
import axios from "axios";
The dependency or client setup enables outbound API calls. That is expected for the example but remains a network access risk factor.
Low
vendored/openserv/openserv-ideaboard-api/examples/browse-ideas.ts:14vendored/openserv/openserv-ideaboard-api/examples/get-api-key.ts:18vendored/openserv/openserv-ideaboard-api/examples/pick-up-and-ship.ts:24
HTTP client library · 3 occurrences
const api = axios.create({
The dependency or client setup enables outbound API calls. That is expected for the example but remains a network access risk factor.
Low
Node.js fs stat operations
if (!fs.existsSync(audioFile)) {
The code checks local file existence or metadata. This is normal validation, but it still accesses user-provided local paths.
Low
Node.js fs stat operations
if (!fs.existsSync(TRANSCRIPT_DIR)) {
The code checks local file existence or metadata. This is normal validation, but it still accesses user-provided local paths.
Low
Node.js fs stat operations
const fileStat = fs.statSync(audioFile);
The code checks local file existence or metadata. This is normal validation, but it still accesses user-provided local paths.
Low
Node.js fs stat operations
if (!fs.existsSync(OUTPUT_DIR)) {
The code checks local file existence or metadata. This is normal validation, but it still accesses user-provided local paths.
Low
Python environment access
1. **Store API keys in environment variables** — never hardcode. Use `process.env.CHAINGPT_API_KEY`
The snippet reads an API key from the environment for an Authorization header. This is direct credential access.
Low
Python environment access
'Authorization': f'Bearer {os.environ["NEAR_API_KEY"]}'
The snippet reads an API key from the environment for an Authorization header. This is direct credential access.
Low
Python HTTP libraries
r = requests.get(f"{BASE_URL}/quote", params=params, headers=HEADERS)
The code performs outbound HTTP requests through Python requests. This is expected integration behavior but still a network access surface.
Low
Python HTTP libraries
return requests.get(f"{BASE_URL}/status", params=params, headers=HEADERS).json()
The code performs outbound HTTP requests through Python requests. This is expected integration behavior but still a network access surface.
Low
Python HTTP libraries
response = requests.get(
The code performs outbound HTTP requests through Python requests. This is expected integration behavior but still a network access surface.
Low
Python HTTP libraries
response = requests.post(
The code performs outbound HTTP requests through Python requests. This is expected integration behavior but still a network access surface.
Low
Python HTTP libraries
let request = self.pending_requests.get(&request_id)
The code performs outbound HTTP requests through Python requests. This is expected integration behavior but still a network access surface.
Low
Standard device file access
command -v okx-a2a >/dev/null 2>&1 || npm i -g @okxweb3/a2a-node
The command installs a global npm package if a tool is missing. Automatic package installation changes the host environment and needs user approval.
Low
Standard device file access
CATALOG=$(curl -fsSL --max-time 5 "https://api.github.com/repos/okx/plugin-store/contents/skills" 2>
The command fetches remote catalog data or installs a plugin. This is expected discovery behavior but has supply-chain impact.
Low
Standard device file access
if npx skills add okx/plugin-store --skill "${DAPP_LOWER}-plugin" --yes --global 2>/dev/null; then
The command fetches remote catalog data or installs a plugin. This is expected discovery behavior but has supply-chain impact.
Risk Factors
🌐 Network access (50)
.claude-plugin/plugin.json:7 .claude-plugin/plugin.json:9 .claude-plugin/plugin.json:10 integrations/genlayer-erc7710-connector/SKILL.md:8 integrations/genlayer-intelligent-contracts/SKILL.md:3 integrations/genlayer-intelligent-contracts/SKILL.md:12 README.md:135 README.md:148 README.md:158 README.md:177 SKILL.md:36 SKILL.md:47 SKILL.md:218 SKILL.md:363 skills-lock.json:138 skills-lock.json:257 skills-lock.json:280 skills-lock.json:711 vendored/0g/0g-compute/README.md:20 vendored/0g/0g-compute/README.md:23 vendored/0g/0g-compute/README.md:26 vendored/0g/0g-compute/references/account-management.md:218 vendored/0g/0g-compute/references/account-management.md:219 vendored/0g/0g-compute/references/account-management.md:568 vendored/0g/0g-compute/references/examples/speech-to-text.md:238 vendored/0g/0g-compute/references/examples/speech-to-text.md:114 vendored/0g/0g-compute/references/examples/speech-to-text.md:143 vendored/0g/0g-compute/references/examples/streaming-chat.md:277 vendored/0g/0g-compute/references/examples/streaming-chat.md:113 vendored/0g/0g-compute/references/examples/streaming-chat.md:144 vendored/0g/0g-compute/references/examples/streaming-chat.md:450 vendored/0g/0g-compute/references/examples/text-to-image.md:188 vendored/0g/0g-compute/references/examples/text-to-image.md:280 vendored/0g/0g-compute/references/examples/text-to-image.md:440 vendored/0g/0g-compute/references/examples/text-to-image.md:457 vendored/0g/0g-compute/references/examples/text-to-image.md:67 vendored/0g/0g-compute/references/examples/text-to-image.md:111 vendored/0g/0g-compute/references/examples/text-to-image.md:138 vendored/0g/0g-compute/references/examples/text-to-image.md:389 vendored/0g/0g-compute/references/inference.md:131 vendored/0g/0g-compute/references/inference.md:156 vendored/0g/0g-compute/references/inference.md:236 vendored/0g/0g-compute/references/inference.md:273 vendored/0g/0g-compute/references/inference.md:296 vendored/0g/0g-compute/references/inference.md:16 vendored/0g/0g-compute/references/inference.md:17 vendored/0g/0g-compute/SKILL.md:73 vendored/0g/0g-compute/SKILL.md:27 vendored/0g/0g-compute/SKILL.md:28 vendored/0g/0g-compute/SKILL.md:56
⚙️ External commands (50)
integrations/genlayer-erc7710-connector/SKILL.md:8 integrations/genlayer-erc7710-connector/SKILL.md:12-18 integrations/genlayer-erc7710-connector/SKILL.md:18-27 integrations/genlayer-erc7710-connector/SKILL.md:27 integrations/genlayer-erc7710-connector/SKILL.md:63-71 integrations/genlayer-erc7710-connector/SKILL.md:71-75 integrations/genlayer-erc7710-connector/SKILL.md:75-76 integrations/genlayer-erc7710-connector/SKILL.md:76-77 integrations/genlayer-erc7710-connector/SKILL.md:77 integrations/genlayer-erc7710-connector/SKILL.md:81-82 integrations/genlayer-erc7710-connector/SKILL.md:82 integrations/genlayer-erc7710-connector/SKILL.md:83 integrations/genlayer-erc7710-connector/SKILL.md:103-106 integrations/genlayer-erc7710-connector/SKILL.md:106-113 integrations/genlayer-erc7710-connector/SKILL.md:113-114 integrations/genlayer-erc7710-connector/SKILL.md:114-115 integrations/genlayer-erc7710-connector/SKILL.md:115-120 integrations/genlayer-erc7710-connector/SKILL.md:120-124 integrations/genlayer-erc7710-connector/SKILL.md:124-127 integrations/genlayer-erc7710-connector/SKILL.md:127-128 integrations/genlayer-erc7710-connector/SKILL.md:128-129 integrations/genlayer-erc7710-connector/SKILL.md:129-132 integrations/genlayer-erc7710-connector/SKILL.md:132-138 integrations/genlayer-erc7710-connector/SKILL.md:138-148 integrations/genlayer-erc7710-connector/SKILL.md:148-159 integrations/genlayer-erc7710-connector/SKILL.md:159-160 integrations/genlayer-erc7710-connector/SKILL.md:160-161 integrations/genlayer-erc7710-connector/SKILL.md:161-162 integrations/genlayer-erc7710-connector/SKILL.md:162 integrations/genlayer-erc7710-connector/SKILL.md:163-178 integrations/genlayer-erc7710-connector/SKILL.md:178-179 integrations/genlayer-erc7710-connector/SKILL.md:179-180 integrations/genlayer-erc7710-connector/SKILL.md:180-193 integrations/genlayer-erc7710-connector/SKILL.md:193-202 integrations/genlayer-intelligent-contracts/references/agent-supervisor-contract.md:40-41 integrations/genlayer-intelligent-contracts/references/agent-supervisor-contract.md:41-44 integrations/genlayer-intelligent-contracts/SKILL.md:12 integrations/genlayer-intelligent-contracts/SKILL.md:16-23 integrations/genlayer-intelligent-contracts/SKILL.md:23-36 integrations/genlayer-intelligent-contracts/SKILL.md:36 integrations/genlayer-intelligent-contracts/SKILL.md:38 integrations/genlayer-intelligent-contracts/SKILL.md:46-70 integrations/genlayer-intelligent-contracts/SKILL.md:70-74 integrations/genlayer-intelligent-contracts/SKILL.md:74-77 integrations/genlayer-intelligent-contracts/SKILL.md:77-79 integrations/genlayer-intelligent-contracts/SKILL.md:79-80 integrations/genlayer-intelligent-contracts/SKILL.md:80-81 integrations/genlayer-intelligent-contracts/SKILL.md:81-82 integrations/genlayer-intelligent-contracts/SKILL.md:82-83 integrations/genlayer-intelligent-contracts/SKILL.md:83-84
📁 Filesystem access (50)
integrations/genlayer-intelligent-contracts/SKILL.md:38 README.md:135 README.md:148 README.md:158 README.md:161 README.md:177 README.md:135 README.md:148 README.md:158 README.md:161 README.md:177 SKILL.md:42 SKILL.md:48 vendored/0g/0g-compute/.github/workflows/claude-code-review.yml:50 vendored/0g/0g-compute/README.md:11 vendored/0g/0g-compute/README.md:12 vendored/0g/0g-compute/README.md:13 vendored/0g/0g-compute/README.md:20 vendored/0g/0g-compute/README.md:23 vendored/0g/0g-compute/README.md:26 vendored/0g/0g-compute/README.md:11 vendored/0g/0g-compute/README.md:12 vendored/0g/0g-compute/README.md:13 vendored/0g/0g-compute/README.md:20 vendored/0g/0g-compute/README.md:23 vendored/0g/0g-compute/README.md:26 vendored/0g/0g-compute/references/examples/README.md:145 vendored/0g/0g-compute/references/examples/README.md:146 vendored/0g/0g-compute/references/examples/README.md:147 vendored/0g/0g-compute/references/examples/README.md:163 vendored/0g/0g-compute/references/examples/speech-to-text.md:299 vendored/0g/0g-compute/references/examples/speech-to-text.md:383 vendored/0g/0g-compute/references/examples/speech-to-text.md:672 vendored/0g/0g-compute/references/examples/speech-to-text.md:287 vendored/0g/0g-compute/references/examples/speech-to-text.md:298 vendored/0g/0g-compute/references/examples/speech-to-text.md:303 vendored/0g/0g-compute/references/examples/speech-to-text.md:383 vendored/0g/0g-compute/references/examples/speech-to-text.md:225 vendored/0g/0g-compute/references/examples/speech-to-text.md:528 vendored/0g/0g-compute/references/examples/speech-to-text.md:341 vendored/0g/0g-compute/references/examples/speech-to-text.md:676 vendored/0g/0g-compute/references/examples/streaming-chat.md:250 vendored/0g/0g-compute/references/examples/streaming-chat.md:273 vendored/0g/0g-compute/references/examples/streaming-chat.md:645 vendored/0g/0g-compute/references/examples/streaming-chat.md:646 vendored/0g/0g-compute/references/examples/text-to-image.md:194 vendored/0g/0g-compute/references/examples/text-to-image.md:228 vendored/0g/0g-compute/references/examples/text-to-image.md:325 vendored/0g/0g-compute/references/examples/text-to-image.md:442 vendored/0g/0g-compute/references/examples/text-to-image.md:446
🔑 Env variables (50)
vendored/0g/0g-compute/.github/workflows/claude-code-review.yml:34 vendored/0g/0g-compute/references/account-management.md:217 vendored/0g/0g-compute/references/account-management.md:222 vendored/0g/0g-compute/references/account-management.md:569 vendored/0g/0g-compute/references/account-management.md:217 vendored/0g/0g-compute/references/account-management.md:222 vendored/0g/0g-compute/references/account-management.md:569 vendored/0g/0g-compute/references/account-management.md:222 vendored/0g/0g-compute/references/account-management.md:569 vendored/0g/0g-compute/references/examples/speech-to-text.md:143 vendored/0g/0g-compute/references/examples/speech-to-text.md:144 vendored/0g/0g-compute/references/examples/speech-to-text.md:145 vendored/0g/0g-compute/references/examples/speech-to-text.md:149 vendored/0g/0g-compute/references/examples/speech-to-text.md:274 vendored/0g/0g-compute/references/examples/speech-to-text.md:311 vendored/0g/0g-compute/references/examples/speech-to-text.md:143 vendored/0g/0g-compute/references/examples/speech-to-text.md:144 vendored/0g/0g-compute/references/examples/speech-to-text.md:145 vendored/0g/0g-compute/references/examples/speech-to-text.md:149 vendored/0g/0g-compute/references/examples/speech-to-text.md:274 vendored/0g/0g-compute/references/examples/speech-to-text.md:311 vendored/0g/0g-compute/references/examples/speech-to-text.md:67 vendored/0g/0g-compute/references/examples/speech-to-text.md:136 vendored/0g/0g-compute/references/examples/speech-to-text.md:141 vendored/0g/0g-compute/references/examples/speech-to-text.md:117 vendored/0g/0g-compute/references/examples/speech-to-text.md:274 vendored/0g/0g-compute/references/examples/speech-to-text.md:275 vendored/0g/0g-compute/references/examples/speech-to-text.md:311 vendored/0g/0g-compute/references/examples/streaming-chat.md:144 vendored/0g/0g-compute/references/examples/streaming-chat.md:148 vendored/0g/0g-compute/references/examples/streaming-chat.md:149 vendored/0g/0g-compute/references/examples/streaming-chat.md:189 vendored/0g/0g-compute/references/examples/streaming-chat.md:201 vendored/0g/0g-compute/references/examples/streaming-chat.md:144 vendored/0g/0g-compute/references/examples/streaming-chat.md:148 vendored/0g/0g-compute/references/examples/streaming-chat.md:149 vendored/0g/0g-compute/references/examples/streaming-chat.md:189 vendored/0g/0g-compute/references/examples/streaming-chat.md:201 vendored/0g/0g-compute/references/examples/streaming-chat.md:66 vendored/0g/0g-compute/references/examples/streaming-chat.md:138 vendored/0g/0g-compute/references/examples/streaming-chat.md:141 vendored/0g/0g-compute/references/examples/streaming-chat.md:116 vendored/0g/0g-compute/references/examples/streaming-chat.md:189 vendored/0g/0g-compute/references/examples/streaming-chat.md:190 vendored/0g/0g-compute/references/examples/streaming-chat.md:201 vendored/0g/0g-compute/references/examples/streaming-chat.md:574 vendored/0g/0g-compute/references/examples/streaming-chat.md:578 vendored/0g/0g-compute/references/examples/text-to-image.md:138 vendored/0g/0g-compute/references/examples/text-to-image.md:139 vendored/0g/0g-compute/references/examples/text-to-image.md:143
⚡ Contains scripts (14)
vendored/arkhai/alkahest-developer/references/python-api.md:16-21 vendored/arkhai/alkahest-developer/references/python-api.md:183-192 vendored/arkhai/alkahest-developer/references/python-api.md:202-208 vendored/arkhai/alkahest-developer/references/python-api.md:235-241 vendored/genlayer/write-contract/SKILL.md:393 vendored/genlayer/write-contract/SKILL.md:407 vendored/genlayer/write-contract/SKILL.md:412 vendored/genlayer/write-contract/SKILL.md:178 vendored/kleros/kleros-ipfs-upload/SKILL.md:107 vendored/okx/okx-agent-payments-protocol/SKILL.md:180 vendored/openserv/openserv-agent-sdk/troubleshooting.md:175 vendored/openserv/openserv-agent-sdk/troubleshooting.md:179 vendored/openserv/openserv-agent-sdk/troubleshooting.md:180 vendored/openserv/openserv-agent-sdk/troubleshooting.md:186
Detected Patterns
Pipe to shell patternPipe to shell patternPipe to shell patternPipe to shell patternPipe to shell patternPipe to shell pattern1Password dataCryptocurrency walletCryptocurrency walletCryptocurrency walletCryptocurrency walletCryptocurrency walletmacOS security command
Audited by: codex