Versioned security assessment
Report ID: SA-3D934537
7/10/2026, 12:15:51 AM
internet-court security assessment v1
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- internet-court
- Version
- v1
- Maintainer
- internet-court
- Coverage
- 379 Files scanned · 59,919 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Critical
39 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Internet Court is high risk because it routes wallet custody, delegated authority, payments, escrow, and disputes across many vendored protocol skills. Confirmed issues include pipe-to-shell installers, private-key handling, environment secrets, privileged commands, eval, filesystem access, and network-loaded sub-skills. Manual review is required before publication or automatic installation. Static review was capped at 400/6831 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
379 Files scanned · 59,919 Lines analyzed
157 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 14 evidence locations
Network access
May connect to external services.
Observed in 61 evidence locations
Filesystem access
May read or write local files.
Observed in 54 evidence locations
Env variables
May read values from the process environment.
Observed in 38 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 63 evidence locations
Capability review items (118)
High
Dynamic code evaluation with eval()
LLMs can't reliably inspect characters in their input (they hallucinate em dashes, miscount characte
The file instructs eval() over expressions generated from natural language rules. Even with a restricted builtins dictionary, dynamic evaluation is a real code-execution risk.
High
Dynamic code evaluation with eval()
# Step 2: eval() all checks in one sandbox — deterministic, no hallucination
The file instructs eval() over expressions generated from natural language rules. Even with a restricted builtins dictionary, dynamic evaluation is a real code-execution risk.
High
Dynamic code evaluation with eval()
ok = eval(c["expression"], {
The file instructs eval() over expressions generated from natural language rules. Even with a restricted builtins dictionary, dynamic evaluation is a real code-execution risk.
High
Generic API/secret keys
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The snippet reads or requires a wallet private key from the environment. This is a real secret and transaction-authority risk.
High
Generic API/secret keys
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The snippet reads or requires a wallet private key from the environment. This is a real secret and transaction-authority risk.
High
Generic API/secret keys
PRIVATE_KEY=your_private_key_here
The snippet reads or requires a wallet private key from the environment. This is a real secret and transaction-authority risk.
High
Generic API/secret keys
if (!process.env.PRIVATE_KEY) {
The snippet reads or requires a wallet private key from the environment. This is a real secret and transaction-authority risk.
High
Generic API/secret keys
throw new Error("PRIVATE_KEY not found in .env");
The snippet reads or requires a wallet private key from the environment. This is a real secret and transaction-authority risk.
High
Generic API/secret keys
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY, provider);
The snippet reads or requires a wallet private key from the environment. This is a real secret and transaction-authority risk.
High
Generic API/secret keys
PRIVATE_KEY=your_private_key_here
The snippet reads or requires a wallet private key from the environment. This is a real secret and transaction-authority risk.
High
Generic API/secret keys
if (!process.env.PRIVATE_KEY) {
The snippet reads or requires a wallet private key from the environment. This is a real secret and transaction-authority risk.
High
Generic API/secret keys
throw new Error("PRIVATE_KEY not found in environment variables");
The snippet reads or requires a wallet private key from the environment. This is a real secret and transaction-authority risk.
High
Generic API/secret keys
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY, provider);
The snippet reads or requires a wallet private key from the environment. This is a real secret and transaction-authority risk.
High
Generic API/secret keys
#### "PRIVATE_KEY not found"
The snippet reads or requires a wallet private key from the environment. This is a real secret and transaction-authority risk.
High
Git platform tokens
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
The workflow injects a GitHub platform token into the job environment. This is standard CI practice, but it is credential access with repository authority.
High
Hidden file in home directory
- Save the resulting session to `~/.altllm/portal-cli-session.json` unless overridden.
The hidden path stores an authenticated portal session. Session files can grant account access if copied or leaked.
High
Hidden file in home directory
`~/.antseed/buyer.state.json` and applies to every request until you change it.
The hidden AntSeed directory stores persistent payment and peer state. It may be operational rather than secret, but it affects paid-service behavior.
High
Hidden file in home directory
- Treat `ANTSEED_IDENTITY_HEX` / `~/.antseed/identity.key` as a hot wallet key.
The hidden path contains a wallet identity key or hot wallet material. This is sensitive custody data stored under the user home directory.
High
Hidden file in home directory
`~/.antseed/buyer.state.json` (`pinnedPeerId`) and applies to every request
The hidden AntSeed directory stores persistent payment and peer state. It may be operational rather than secret, but it affects paid-service behavior.
High
Hidden file in home directory
## Files the CLI creates in `~/.antseed/`
The hidden AntSeed directory stores persistent payment and peer state. It may be operational rather than secret, but it affects paid-service behavior.
High
sudo privilege escalation
sudo systemctl restart hermes
The snippet instructs use of sudo to restart or inspect a system service. Privileged service control can affect the host and must require explicit user approval.
High
sudo privilege escalation
> Or whatever supervisor you use. Then check the journal: `sudo journalctl -u hermes --no-pager -n 3
The snippet instructs use of sudo to restart or inspect a system service. Privileged service control can affect the host and must require explicit user approval.
High
sudo privilege escalation
- *Want to swap the routed model without restarting AntSeed* — Edit `model.default` (and `models:` i
The snippet instructs use of sudo to restart or inspect a system service. Privileged service control can affect the host and must require explicit user approval.
Medium
Dynamic import() expression
node -e "import('viem/accounts').then(m => console.log(m.generatePrivateKey()))"
The dynamic import appears in a one-line command that generates wallet key material. The import is controlled, but the surrounding operation is security-sensitive.
Medium
File stream creation
const fileStream = fs.createReadStream(audioFilePath);
The example creates a file stream from a local path for upload or processing. This is legitimate, but user-controlled paths can expose unintended local files.
Medium
File stream creation
const fileStream = fs.createReadStream(audioFilePath);
The example creates a file stream from a local path for upload or processing. This is legitimate, but user-controlled paths can expose unintended local files.
Medium
Hidden file access
"sessionFile": "/Users/<user>/.altllm/portal-cli-session.json",
The hidden path stores an authenticated portal session. Session files can grant account access if copied or leaked.
Medium
Hidden file access
"sessionFile": "/Users/<user>/.altllm/portal-cli-session.json",
The hidden path stores an authenticated portal session. Session files can grant account access if copied or leaked.
Medium
Hidden file access
- Save the resulting session to `~/.altllm/portal-cli-session.json` unless overridden.
The hidden path stores an authenticated portal session. Session files can grant account access if copied or leaked.
Medium
Hidden file access
`~/.antseed/buyer.state.json` and applies to every request until you change it.
The hidden AntSeed directory stores persistent payment and peer state. It may be operational rather than secret, but it affects paid-service behavior.
Medium
Hidden file access
- Treat `ANTSEED_IDENTITY_HEX` / `~/.antseed/identity.key` as a hot wallet key.
The hidden path contains a wallet identity key or hot wallet material. This is sensitive custody data stored under the user home directory.
Medium
Node.js fs operations
fs.mkdirSync(TRANSCRIPT_DIR, { recursive: true });
The example performs local filesystem reads, writes, directory creation, or directory listing. Legitimate examples still require review for path safety.
Medium
Node.js fs operations
fs.writeFileSync(outputFile, outputContent);
The example performs local filesystem reads, writes, directory creation, or directory listing. Legitimate examples still require review for path safety.
Medium
Node.js fs operations
const audioFiles = fs.readdirSync(AUDIO_DIR)
The example performs local filesystem reads, writes, directory creation, or directory listing. Legitimate examples still require review for path safety.
Medium
Node.js fs operations
fs.writeFileSync(filepath, Buffer.from(buffer));
The example performs local filesystem reads, writes, directory creation, or directory listing. Legitimate examples still require review for path safety.
Medium
Node.js fs operations
fs.mkdirSync(OUTPUT_DIR, { recursive: true });
The example performs local filesystem reads, writes, directory creation, or directory listing. Legitimate examples still require review for path safety.
Medium
Node.js fs operations
fs.writeFileSync(filepath, Buffer.from(base64Data, "base64"));
The example performs local filesystem reads, writes, directory creation, or directory listing. Legitimate examples still require review for path safety.
Medium
Node.js fs operations
fs.writeFileSync(filepath, Buffer.from(buffer));
The example performs local filesystem reads, writes, directory creation, or directory listing. Legitimate examples still require review for path safety.
Medium
Node.js fs operations
fs.writeFileSync(filepath, Buffer.from(base64Data, "base64"));
The example performs local filesystem reads, writes, directory creation, or directory listing. Legitimate examples still require review for path safety.
Medium
Shell command substitution
PERMISSION=$(gh api repos/${{ github.repository }}/collaborators/$ACTOR/permission --jq '.permission
The workflow runs a GitHub CLI command and stores the result through shell substitution. It appears legitimate, but it exercises repository API access.
Medium
Shell command substitution
export ANTSEED_IDENTITY_HEX=$(openssl rand -hex 32)
The shell substitution is part of wallet key generation, signature creation, or payment-header construction. That is security-sensitive command execution.
Medium
Shell command substitution
WALLET=$(cast wallet address --private-key "$PRIVATE_KEY")
The shell substitution is part of wallet key generation, signature creation, or payment-header construction. That is security-sensitive command execution.
Medium
Shell command substitution
NONCE=0x$(openssl rand -hex 32)
The shell substitution is part of wallet key generation, signature creation, or payment-header construction. That is security-sensitive command execution.
Medium
Shell command substitution
SIG=$(cast wallet sign --data --from-file --private-key "$PRIVATE_KEY" /tmp/eip712.json)
The shell substitution is part of wallet key generation, signature creation, or payment-header construction. That is security-sensitive command execution.
Medium
Shell command substitution
X_PAYMENT=$(printf '{"x402Version":1,"scheme":"exact","network":"base","payload":{"signature":"%s","
The shell substitution is part of wallet key generation, signature creation, or payment-header construction. That is security-sensitive command execution.
Medium
Synchronous file operations
fs.writeFileSync(outputFile, outputContent);
The sample writes files synchronously to local paths. This is normal example code, but it can overwrite data if paths are user-controlled.
Medium
Synchronous file operations
fs.writeFileSync(filepath, Buffer.from(buffer));
The sample writes files synchronously to local paths. This is normal example code, but it can overwrite data if paths are user-controlled.
Medium
Synchronous file operations
fs.writeFileSync(filepath, Buffer.from(base64Data, "base64"));
The sample writes files synchronously to local paths. This is normal example code, but it can overwrite data if paths are user-controlled.
Medium
Synchronous file operations
fs.writeFileSync(filepath, Buffer.from(buffer));
The sample writes files synchronously to local paths. This is normal example code, but it can overwrite data if paths are user-controlled.
Medium
Synchronous file operations
fs.writeFileSync(filepath, Buffer.from(base64Data, "base64"));
The sample writes files synchronously to local paths. This is normal example code, but it can overwrite data if paths are user-controlled.
Medium
Temp directory access
2. Clone it to a temporary location: `git clone <url> /tmp/escrow-tests-<uid> && cd /tmp/escrow-test
The instruction clones a user-provided repository into /tmp and changes into it. That workflow can expose the agent to untrusted repository content.
Medium
Temp directory access
cat > /tmp/eip712.json << EOF
The temporary file path participates in signing or paid upload workflows. Temporary storage of wallet or evidence material needs review.
Medium
Temp directory access
SIG=$(cast wallet sign --data --from-file --private-key "$PRIVATE_KEY" /tmp/eip712.json)
The temporary file path participates in signing or paid upload workflows. Temporary storage of wallet or evidence material needs review.
Medium
Temp directory access
2. Run the bundled script: `EVM_PRIVATE_KEY=0x... npx tsx pay-and-upload.ts /tmp/exhibit-a.png`.
The temporary file path participates in signing or paid upload workflows. Temporary storage of wallet or evidence material needs review.
Medium
Temp directory access
1. Write its **raw JSON** to `/tmp/a2a_deliver_<jobId>.json` first.
The instruction writes raw agent-delivery JSON into /tmp. This may be operational, but temporary files can expose sensitive task data.
Medium
Template literal with command substitution
```bash
The bash block around this line generates a wallet identity key and configures paid-service access. The command block is security-sensitive.
Medium
Template literal with command substitution
```bash
The surrounding bash probes a remote plugin catalog or installs a plugin based on user input. This is legitimate routing logic but needs command-review boundaries.
Medium
Template literal with command substitution
```bash
The surrounding bash probes a remote plugin catalog or installs a plugin based on user input. This is legitimate routing logic but needs command-review boundaries.
Medium
xargs command (can execute arbitrary commands)
lsof -ti:7378 | xargs kill -9
The command pipes process ids into kill -9. It is a troubleshooting command, but it can terminate local processes and should require explicit approval.
Low
dotenv library
import * as dotenv from "dotenv";
The file imports dotenv for environment loading in credential-backed examples. The import alone is not dangerous, but it supports secret access.
Low
dotenv library
dotenv.config();
The code loads environment variables into the process. This is standard practice, but these examples also handle wallet or provider credentials.
Low
dotenv library
import * as dotenv from "dotenv";
The file imports dotenv for environment loading in credential-backed examples. The import alone is not dangerous, but it supports secret access.
Low
dotenv library
dotenv.config();
The code loads environment variables into the process. This is standard practice, but these examples also handle wallet or provider credentials.
Low
dotenv library
import * as dotenv from "dotenv";
The file imports dotenv for environment loading in credential-backed examples. The import alone is not dangerous, but it supports secret access.
Low
dotenv library
dotenv.config();
The code loads environment variables into the process. This is standard practice, but these examples also handle wallet or provider credentials.
Low
dotenv library
import 'dotenv/config'
The code loads environment variables into the process. This is standard practice, but these examples also handle wallet or provider credentials.
Low
dotenv library
import 'dotenv/config'
The code loads environment variables into the process. This is standard practice, but these examples also handle wallet or provider credentials.
Low
Environment variable access (bracket notation)
for (const key of required) creds[key] = process.env[key];
The code reads named credentials or account settings from process.env using bracket notation. The surrounding examples include API keys or wallet keys.
Low
Environment variable access (bracket notation)
const value = process.env[name]?.trim();
The code reads named credentials or account settings from process.env using bracket notation. The surrounding examples include API keys or wallet keys.
Low
Environment variable access (dot notation)
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The code reads a wallet private key from process.env. This is direct access to sensitive transaction authority.
Low
Environment variable access (dot notation)
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The code reads a wallet private key from process.env. This is direct access to sensitive transaction authority.
Low
Environment variable access (dot notation)
if (!process.env.PRIVATE_KEY) {
The code reads a wallet private key from process.env. This is direct access to sensitive transaction authority.
Low
Environment variable access (dot notation)
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY, provider);
The code reads a wallet private key from process.env. This is direct access to sensitive transaction authority.
Low
Environment variable object
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The code reads a wallet private key from process.env. This is direct access to sensitive transaction authority.
Low
Environment variable object
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The code reads a wallet private key from process.env. This is direct access to sensitive transaction authority.
Low
Environment variable object
if (!process.env.PRIVATE_KEY) {
The code reads a wallet private key from process.env. This is direct access to sensitive transaction authority.
Low
Environment variable object
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY, provider);
The code reads a wallet private key from process.env. This is direct access to sensitive transaction authority.
Low
Fetch API call
const response = await fetch(\`\${endpoint}/audio/transcriptions\`, {
The code sends requests to model or inference endpoints. Network calls are expected here but still expose prompts, files, or paid-service activity externally.
Low
Fetch API call
const response = await fetch(\`\${endpoint}/chat/completions\`, {
The code sends requests to model or inference endpoints. Network calls are expected here but still expose prompts, files, or paid-service activity externally.
Low
Fetch API call
const response = await fetch(url);
The code sends requests to model or inference endpoints. Network calls are expected here but still expose prompts, files, or paid-service activity externally.
Low
Fetch API call
const response = await fetch(\`\${endpoint}/images/generations\`, {
The code sends requests to model or inference endpoints. Network calls are expected here but still expose prompts, files, or paid-service activity externally.
Low
Fetch API call
const response = await fetch(imageUrl);
The code sends requests to model or inference endpoints. Network calls are expected here but still expose prompts, files, or paid-service activity externally.
Low
Fetch API call
const response = await fetch(...);
The code sends requests to model or inference endpoints. Network calls are expected here but still expose prompts, files, or paid-service activity externally.
Low
Fetch API call
const response = await fetch(`${endpoint}/chat/completions`, {
The code sends requests to model or inference endpoints. Network calls are expected here but still expose prompts, files, or paid-service activity externally.
Low
Fetch API call
const response = await fetch(`${endpoint}/chat/completions`, {
The code sends requests to model or inference endpoints. Network calls are expected here but still expose prompts, files, or paid-service activity externally.
Low
Fetch API call
const response = await fetch(`${endpoint}/images/generations`, {
The code sends requests to model or inference endpoints. Network calls are expected here but still expose prompts, files, or paid-service activity externally.
Low
Fetch API call
const response = await fetch(`${endpoint}/audio/transcriptions`, {
The code sends requests to model or inference endpoints. Network calls are expected here but still expose prompts, files, or paid-service activity externally.
Low
Hardcoded URL
`https://raw.githubusercontent.com/internet-court/internet-court-skill/main/<path>`
The URL is a raw GitHub fallback for loading skill files. Fetching executable instructions from the network can bypass the bundled audit unless pinned and verified.
Low
Hardcoded URL
| Settle a narrow binary question from public web evidence (prediction market / factual oracle) | `v
The skill intentionally uses public web evidence or external oracle URLs. This is expected functionality but still a network dependency.
Low
Hardcoded URL
"source": "https://www.intelligentoracle.com/skill.md",
The skill intentionally uses public web evidence or external oracle URLs. This is expected functionality but still a network dependency.
Low
Hardcoded URL
? "https://evmrpc.0g.ai" // Mainnet
The URL points to an external blockchain RPC endpoint. This is expected but creates a network dependency and potential metadata exposure.
Low
Hardcoded URL
: "https://evmrpc-testnet.0g.ai"; // Testnet
The URL points to an external blockchain RPC endpoint. This is expected but creates a network dependency and potential metadata exposure.
Low
Hardcoded URL
const provider = new ethers.JsonRpcProvider("https://evmrpc-testnet.0g.ai");
The URL points to an external blockchain RPC endpoint. This is expected but creates a network dependency and potential metadata exposure.
Low
Hardcoded URL
RPC_URL=https://evmrpc.0g.ai
The URL points to an external blockchain RPC endpoint. This is expected but creates a network dependency and potential metadata exposure.
Low
Hardcoded URL
const RPC_URL = process.env.RPC_URL || "https://evmrpc.0g.ai";
The URL points to an external blockchain RPC endpoint. This is expected but creates a network dependency and potential metadata exposure.
Low
Hardcoded URL
RPC_URL=https://evmrpc.0g.ai
The URL points to an external blockchain RPC endpoint. This is expected but creates a network dependency and potential metadata exposure.
Low
Hardcoded URL
const RPC_URL = process.env.RPC_URL || "https://evmrpc.0g.ai";
The URL points to an external blockchain RPC endpoint. This is expected but creates a network dependency and potential metadata exposure.
Low
HTTP client library
"node-fetch": "^3.3.2"
The dependency or client setup enables outbound API calls. That is expected for the example but remains a network access risk factor.
Low
HTTP client library
import axios from "axios";
The dependency or client setup enables outbound API calls. That is expected for the example but remains a network access risk factor.
Low
HTTP client library
const api = axios.create({
The dependency or client setup enables outbound API calls. That is expected for the example but remains a network access risk factor.
Low
HTTP client library
import axios from "axios";
The dependency or client setup enables outbound API calls. That is expected for the example but remains a network access risk factor.
Low
HTTP client library
const api = axios.create({
The dependency or client setup enables outbound API calls. That is expected for the example but remains a network access risk factor.
Low
HTTP client library
import axios from "axios";
The dependency or client setup enables outbound API calls. That is expected for the example but remains a network access risk factor.
Low
HTTP client library
const api = axios.create({
The dependency or client setup enables outbound API calls. That is expected for the example but remains a network access risk factor.
Low
Node.js fs stat operations
if (!fs.existsSync(audioFile)) {
The code checks local file existence or metadata. This is normal validation, but it still accesses user-provided local paths.
Low
Node.js fs stat operations
if (!fs.existsSync(TRANSCRIPT_DIR)) {
The code checks local file existence or metadata. This is normal validation, but it still accesses user-provided local paths.
Low
Node.js fs stat operations
const fileStat = fs.statSync(audioFile);
The code checks local file existence or metadata. This is normal validation, but it still accesses user-provided local paths.
Low
Node.js fs stat operations
if (!fs.existsSync(OUTPUT_DIR)) {
The code checks local file existence or metadata. This is normal validation, but it still accesses user-provided local paths.
Low
Python environment access
1. **Store API keys in environment variables** — never hardcode. Use `process.env.CHAINGPT_API_KEY`
The snippet reads an API key from the environment for an Authorization header. This is direct credential access.
Low
Python environment access
'Authorization': f'Bearer {os.environ["NEAR_API_KEY"]}'
The snippet reads an API key from the environment for an Authorization header. This is direct credential access.
Low
Python HTTP libraries
r = requests.get(f"{BASE_URL}/quote", params=params, headers=HEADERS)
The code performs outbound HTTP requests through Python requests. This is expected integration behavior but still a network access surface.
Low
Python HTTP libraries
return requests.get(f"{BASE_URL}/status", params=params, headers=HEADERS).json()
The code performs outbound HTTP requests through Python requests. This is expected integration behavior but still a network access surface.
Low
Python HTTP libraries
response = requests.get(
The code performs outbound HTTP requests through Python requests. This is expected integration behavior but still a network access surface.
Low
Python HTTP libraries
response = requests.post(
The code performs outbound HTTP requests through Python requests. This is expected integration behavior but still a network access surface.
Low
Python HTTP libraries
let request = self.pending_requests.get(&request_id)
The code performs outbound HTTP requests through Python requests. This is expected integration behavior but still a network access surface.
Low
Standard device file access
command -v okx-a2a >/dev/null 2>&1 || npm i -g @okxweb3/a2a-node
The command installs a global npm package if a tool is missing. Automatic package installation changes the host environment and needs user approval.
Low
Standard device file access
CATALOG=$(curl -fsSL --max-time 5 "https://api.github.com/repos/okx/plugin-store/contents/skills" 2>
The command fetches remote catalog data or installs a plugin. This is expected discovery behavior but has supply-chain impact.
Low
Standard device file access
if npx skills add okx/plugin-store --skill "${DAPP_LOWER}-plugin" --yes --global 2>/dev/null; then
The command fetches remote catalog data or installs a plugin. This is expected discovery behavior but has supply-chain impact.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (39)
RISK-001 Critical
Pipe to shell pattern
curl -L https://foundry.paradigm.xyz | bash
The finding pipes network-downloaded installer content directly into a shell. That is a real supply-chain execution risk without local review or checksum verification.
RISK-002 Critical
Pipe to shell pattern
- `cast` from Foundry (`curl -L https://foundry.paradigm.xyz | bash && foundryup`)
The finding pipes network-downloaded installer content directly into a shell. That is a real supply-chain execution risk without local review or checksum verification.
RISK-003 Critical
Pipe to shell pattern
curl -fsSL https://tempo.xyz/install | bash
The finding pipes network-downloaded installer content directly into a shell. That is a real supply-chain execution risk without local review or checksum verification.
RISK-004 Critical
Pipe to shell pattern
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
The finding pipes network-downloaded installer content directly into a shell. That is a real supply-chain execution risk without local review or checksum verification.
RISK-005 Critical
Pipe to shell pattern
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/cargo-near/releases/latest/download/ca
The finding pipes network-downloaded installer content directly into a shell. That is a real supply-chain execution risk without local review or checksum verification.
RISK-006 Critical
Pipe to shell pattern
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/near-cli-rs/releases/latest/download/n
The finding pipes network-downloaded installer content directly into a shell. That is a real supply-chain execution risk without local review or checksum verification.
RISK-007 Critical
1Password data
- **Recover lost passphrases.** Lose `CHAINGPT_AGENT_WALLET_PASSPHRASE` → the keystore is unrecovera
The text handles a wallet passphrase and keystore recovery boundary. It is legitimate guidance, but it is a real secret-handling surface where disclosure or loss can compromise funds.
RISK-008 Critical
Cryptocurrency wallet
if (typeof window.ethereum === "undefined") {
The snippet accesses a browser or server wallet interface capable of signing or sending transactions. Wallet access is a real funds-at-risk security surface.
RISK-009 Critical
Cryptocurrency wallet
const provider = new BrowserProvider(window.ethereum);
The snippet accesses a browser or server wallet interface capable of signing or sending transactions. Wallet access is a real funds-at-risk security surface.
RISK-010 Critical
Cryptocurrency wallet
transport: custom(window.ethereum),
The snippet accesses a browser or server wallet interface capable of signing or sending transactions. Wallet access is a real funds-at-risk security surface.
RISK-011 Critical
Cryptocurrency wallet
Available chain adapters: `evm.EVM`, `bitcoin.Bitcoin`, `solana.Solana`, `cosmos.Cosmos`, `xrp.XRP`,
The text describes cryptocurrency chain adapters in a signing context. It is not malicious by itself, but it confirms wallet-related authority is in scope.
RISK-012 Critical
Cryptocurrency wallet
- **Server-side:** Call `privy.wallets().ethereum().sendTransaction()` or equivalent
The snippet accesses a browser or server wallet interface capable of signing or sending transactions. Wallet access is a real funds-at-risk security surface.
RISK-013 Critical
macOS security command
> **Back up the passphrase either way.** Keychain entry: `service=chaingpt-mcp-agent-wallet account=
The text references storing or recovering a wallet passphrase through the macOS Keychain. This is a legitimate pattern but still exposes sensitive wallet custody material.
RISK-014 High
Certificate/key files
- Treat `ANTSEED_IDENTITY_HEX` / `~/.antseed/identity.key` as a hot wallet key.
The snippet identifies a wallet identity key or hot wallet secret. Losing or exposing this key can compromise funds or paid-service authority.
RISK-015 High
Certificate/key files
| `identity.key` | Raw 32-byte EVM private key for the buyer wallet. Fallback when `ANTSEED_IDENTITY
The snippet identifies a wallet identity key or hot wallet secret. Losing or exposing this key can compromise funds or paid-service authority.
RISK-016 High
Certificate/key files
| `identity.enc` | Encrypted copy of `identity.key` (when the desktop app sets a passphrase). | yes
The snippet identifies a wallet identity key or hot wallet secret. Losing or exposing this key can compromise funds or paid-service authority.
RISK-017 High
Crypto seed/private key mention
- The page generates a real agent EOA for the demo and exports a JSON package containing the agent p
The finding references wallet key material in a commerce workflow. Context appears legitimate, but it remains sensitive enough to keep for review.
RISK-018 High
Crypto seed/private key mention
The exported agent package is a bearer capability in demo form. Include explicit warnings, keep caps
The finding references wallet key material in a commerce workflow. Context appears legitimate, but it remains sensitive enough to keep for review.
RISK-019 High
Crypto seed/private key mention
- include private key in exported JSON or omit it;
The snippet involves generating, exporting, entering, or using wallet private-key material. That creates direct custody and funds-loss risk if mishandled.
RISK-020 High
Crypto seed/private key mention
| Give an agent a wallet with a built-in policy gate (per-tx caps, velocity limits, session keys) in
The finding references wallet key material in a commerce workflow. Context appears legitimate, but it remains sensitive enough to keep for review.
RISK-021 High
Crypto seed/private key mention
# Login with wallet private key
The snippet involves generating, exporting, entering, or using wallet private-key material. That creates direct custody and funds-loss risk if mishandled.
RISK-022 High
Crypto seed/private key mention
# Enter private key when prompted
The snippet involves generating, exporting, entering, or using wallet private-key material. That creates direct custody and funds-loss risk if mishandled.
RISK-023 High
Crypto seed/private key mention
2. **Environment configuration**: Setup `.env` file with private key
The snippet involves generating, exporting, entering, or using wallet private-key material. That creates direct custody and funds-loss risk if mishandled.
RISK-024 High
Crypto seed/private key mention
# Your wallet private key
The snippet involves generating, exporting, entering, or using wallet private-key material. That creates direct custody and funds-loss risk if mishandled.
RISK-025 High
Crypto seed/private key mention
# Your wallet private key
The snippet involves generating, exporting, entering, or using wallet private-key material. That creates direct custody and funds-loss risk if mishandled.
RISK-026 High
Crypto seed/private key mention
- Decrypts the key using your private key
The snippet involves generating, exporting, entering, or using wallet private-key material. That creates direct custody and funds-loss risk if mishandled.
RISK-027 High
Crypto seed/private key mention
- Ensure you're using the correct private key
The snippet involves generating, exporting, entering, or using wallet private-key material. That creates direct custody and funds-loss risk if mishandled.
RISK-028 High
Crypto seed/private key mention
### Private Key Safety
The snippet involves generating, exporting, entering, or using wallet private-key material. That creates direct custody and funds-loss risk if mishandled.
RISK-029 High
Environment file access
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The example stores or reads wallet private-key material from an environment file. Environment-backed wallet keys are a real secret-handling risk.
RISK-030 High
Environment file access
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The example stores or reads wallet private-key material from an environment file. Environment-backed wallet keys are a real secret-handling risk.
RISK-031 High
Environment file access
2. **Environment configuration**: Setup `.env` file with private key
The example stores or reads wallet private-key material from an environment file. Environment-backed wallet keys are a real secret-handling risk.
RISK-032 High
Environment file access
Create `.env`:
The example stores or reads wallet private-key material from an environment file. Environment-backed wallet keys are a real secret-handling risk.
RISK-033 High
Environment variant files
This deploys a **fresh factory contract** (writing the new address to `.env.local`), not a new oracl
The finding references an environment variant file. It may be benign configuration, but these files commonly store secrets and require manual review.
RISK-034 High
Environment variant files
# .env.local
The finding references an environment variant file. It may be benign configuration, but these files commonly store secrets and require manual review.
RISK-035 High
Dynamic Remote Skill Loading Bypasses Bundled Review
The master skill tells agents to fetch missing sibling skills from raw GitHub when only the root skill is installed. That can load network content outside the bundled audit unless fetched files are pinned and verified.
Lines 42-48 describe the root-only install path and raw GitHub fallback. This is an intent-level supply-chain risk beyond a simple hardcoded URL.
RISK-036 Medium
SQLite database file
| `metering.db` | SQLite log of every request the proxy served (model, peer, tokens, USDC). Used by
The file documents a SQLite log containing request, token, and USDC metering data. That is persistent operational and payment metadata.
RISK-037 Low
Unscanned file (invalid_frontmatter) — manual review required
[unscanned: invalid_frontmatter]
The file could not be statically scanned because of invalid frontmatter. Manual review is required before treating that vendored skill as safe.
RISK-038 Low
Unscanned file (invalid_frontmatter) — manual review required
[unscanned: invalid_frontmatter]
The file could not be statically scanned because of invalid frontmatter. Manual review is required before treating that vendored skill as safe.
RISK-039 Low
Unscanned file (invalid_frontmatter) — manual review required
[unscanned: invalid_frontmatter]
The file could not be statically scanned because of invalid frontmatter. Manual review is required before treating that vendored skill as safe.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalRemote installer commands pipe downloaded scripts directly into a shell.Replace curl-to-shell instructions with package-manager installs, pinned artifacts, checksum verification, and explicit user approval.
- FIX-002HighDemo and vendored workflows handle wallet private keys, exported agent packages, and environment-backed secrets.Avoid exporting private keys, prefer wallet prompts or scoped delegations, encrypt any local artifacts, and keep examples on disposable test wallets.
- FIX-003HighThe root skill can fetch sibling skills from raw GitHub when only SKILL.md is installed.Require full-repository installation or verify remote fallback files with pinned hashes and signed manifests before loading them.
- FIX-004HighA GenLayer example evaluates LLM-generated Python expressions with eval().Replace eval with a constrained expression parser, declarative rule DSL, or explicit allowlisted checks.
- FIX-005HighSome instructions use sudo, global installs, plugin installs, or commands that can terminate local processes.Mark these as manual operator steps, require confirmation, and avoid automatic execution by agents.
- FIX-006MediumStatic review cappedManually review the omitted 6431 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable