Versioned security assessment
Report ID: SA-3F6E026A
7/19/2026, 10:16:26 AM
internet-court security assessment v2
Skill Security Certification Report
Scanner version 3.0.0 Audit model: codex Latest published report
- Skill name
- internet-court
- Version
- v2
- Maintainer
- internet-court
- Coverage
- 376 Files scanned · 59,995 Lines analyzed
- Policy version
- skillstore-security-audit-policy-v1
Highest confirmed finding severity
Critical
28 confirmed security findings require attention.
Installation context
Check the current Skill page
This page summarizes report evidence only. The Skill page provides the canonical install advisory.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
The bundle contains confirmed critical remote installer pipelines, secret-retrieval commands, model-generated eval, plaintext private-key workflows, and silent global plugin installation. Many remaining matches are lexical false positives, but the confirmed supply-chain and credential risks prevent unattended use. Static review was capped at 400/6908 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
Report position
Latest published report
Latest refers to the report sequence, not to artifact currentness.
Audit attestation
Attestation unavailable
No public attestation is available for this report.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
376 Files scanned · 59,995 Lines analyzed
80 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Commit and path bound
Artifact
Content and tree hashes bound
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 14 evidence locations
Network access
May connect to external services.
Observed in 50 evidence locations
Filesystem access
May read or write local files.
Observed in 47 evidence locations
Env variables
May read values from the process environment.
Observed in 37 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 57 evidence locations
Capability review items (52)
High
Dynamic code evaluation with eval()
LLMs can't reliably inspect characters in their input (they hallucinate em dashes, miscount characte
The guide generates Python expressions with an LLM and executes them through eval. Restricted builtins reduce risk but do not make model output trusted.
High
Dynamic code evaluation with eval()
# Step 2: eval() all checks in one sandbox — deterministic, no hallucination
The guide generates Python expressions with an LLM and executes them through eval. Restricted builtins reduce risk but do not make model output trusted.
High
Dynamic code evaluation with eval()
ok = eval(c["expression"], {
The guide generates Python expressions with an LLM and executes them through eval. Restricted builtins reduce risk but do not make model output trusted.
High
Generic API/secret keys
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The example reads a wallet private key from environment variables and uses it for signing. Environment disclosure could lead to unauthorized transactions.
High
Generic API/secret keys
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The example reads a wallet private key from environment variables and uses it for signing. Environment disclosure could lead to unauthorized transactions.
High
Generic API/secret keys
PRIVATE_KEY=your_private_key_here
The example reads a wallet private key from environment variables and uses it for signing. Environment disclosure could lead to unauthorized transactions.
High
Generic API/secret keys
if (!process.env.PRIVATE_KEY) {
The example reads a wallet private key from environment variables and uses it for signing. Environment disclosure could lead to unauthorized transactions.
High
Generic API/secret keys
throw new Error("PRIVATE_KEY not found in .env");
The example reads a wallet private key from environment variables and uses it for signing. Environment disclosure could lead to unauthorized transactions.
High
Generic API/secret keys
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY, provider);
The example reads a wallet private key from environment variables and uses it for signing. Environment disclosure could lead to unauthorized transactions.
High
Generic API/secret keys
PRIVATE_KEY=your_private_key_here
The example reads a wallet private key from environment variables and uses it for signing. Environment disclosure could lead to unauthorized transactions.
High
Generic API/secret keys
if (!process.env.PRIVATE_KEY) {
The example reads a wallet private key from environment variables and uses it for signing. Environment disclosure could lead to unauthorized transactions.
High
Generic API/secret keys
throw new Error("PRIVATE_KEY not found in environment variables");
The example reads a wallet private key from environment variables and uses it for signing. Environment disclosure could lead to unauthorized transactions.
High
Generic API/secret keys
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY, provider);
The example reads a wallet private key from environment variables and uses it for signing. Environment disclosure could lead to unauthorized transactions.
High
Generic API/secret keys
#### "PRIVATE_KEY not found"
The example reads a wallet private key from environment variables and uses it for signing. Environment disclosure could lead to unauthorized transactions.
High
Generic API/secret keys
PRIVATE_KEY=your_private_key_here
The example reads a wallet private key from environment variables and uses it for signing. Environment disclosure could lead to unauthorized transactions.
High
Hidden file in home directory
- Save the resulting session to `~/.altllm/portal-cli-session.json` unless overridden.
The guide persists an authenticated session under the home directory. Weak permissions, backups, or unintended reads could expose reusable credentials.
High
Hidden file in home directory
- Treat `ANTSEED_IDENTITY_HEX` / `~/.antseed/identity.key` as a hot wallet key.
The cited hidden file is a raw funded-wallet private key. Local disclosure or unsafe backup would permit unauthorized signing.
High
sudo privilege escalation
sudo systemctl restart hermes
The guide directs the agent to restart a system service with sudo. This privileged and disruptive operation requires explicit user approval.
High
sudo privilege escalation
> Or whatever supervisor you use. Then check the journal: `sudo journalctl -u hermes --no-pager -n 3
The guide invokes sudo to read service logs, which may expose sensitive runtime data. Elevated access should require explicit user approval.
High
sudo privilege escalation
- *Want to swap the routed model without restarting AntSeed* — Edit `model.default` (and `models:` i
The guide directs the agent to restart a system service with sudo. This privileged and disruptive operation requires explicit user approval.
Medium
Hidden file access
"sessionFile": "/Users/<user>/.altllm/portal-cli-session.json",
The configuration points to a persisted authenticated session file. Weak file permissions or unintended reads could expose reusable credentials.
Medium
Hidden file access
"sessionFile": "/Users/<user>/.altllm/portal-cli-session.json",
The configuration points to a persisted authenticated session file. Weak file permissions or unintended reads could expose reusable credentials.
Medium
Hidden file access
- Save the resulting session to `~/.altllm/portal-cli-session.json` unless overridden.
The guide persists an authenticated session in a hidden home directory. Weak file permissions or backups could expose reusable credentials.
Medium
Hidden file access
- Treat `ANTSEED_IDENTITY_HEX` / `~/.antseed/identity.key` as a hot wallet key.
The cited hidden file contains a raw funded-wallet private key. Unintended local access would permit unauthorized signing.
Medium
Shell command substitution
export ANTSEED_IDENTITY_HEX=$(openssl rand -hex 32)
The command creates a raw wallet key and exports it into the process environment. Child processes or environment capture could expose it.
Medium
Shell command substitution
WALLET=$(cast wallet address --private-key "$PRIVATE_KEY")
The command expands a wallet private key into a process argument. Process inspection, debugging output, or shell tracing could expose the secret.
Medium
Shell command substitution
SIG=$(cast wallet sign --data --from-file --private-key "$PRIVATE_KEY" /tmp/eip712.json)
The command expands a wallet private key into a process argument. Process inspection, debugging output, or shell tracing could expose the secret.
Medium
Temp directory access
2. Clone it to a temporary location: `git clone <url> /tmp/escrow-tests-<uid> && cd /tmp/escrow-test
The guide clones an externally supplied repository into a predictable temporary path. Existing paths, symlinks, or crafted identifiers could redirect writes.
Medium
Temp directory access
cat > /tmp/eip712.json << EOF
The payment flow writes or reads a fixed temporary filename. Another local process could replace it through a symlink or race.
Medium
Temp directory access
SIG=$(cast wallet sign --data --from-file --private-key "$PRIVATE_KEY" /tmp/eip712.json)
The payment flow writes or reads a fixed temporary filename. Another local process could replace it through a symlink or race.
Medium
Temp directory access
| 1 | Contains `[intent:deliver]` | **Highest priority — process THIS TURN before any other CLI call
The workflow stores untrusted peer JSON in a predictable path derived from a job identifier. Missing validation creates overwrite and symlink risks.
Medium
Temp directory access
1. Write its **raw JSON** to `/tmp/a2a_deliver_<jobId>.json` first.
The workflow stores untrusted peer JSON in a predictable path derived from a job identifier. Missing validation creates overwrite and symlink risks.
Medium
xargs command (can execute arbitrary commands)
lsof -ti:7378 | xargs kill -9
The command force-kills every process listening on a port without checking ownership or identity. It can terminate an unrelated process.
Medium
Fetch API call
const response = await fetch(url);
The example fetches an unvalidated image URL without host or size limits. A malicious provider response could cause SSRF or resource exhaustion.
Medium
Fetch API call
const response = await fetch(imageUrl);
The example fetches an unvalidated image URL without host or size limits. A malicious provider response could cause SSRF or resource exhaustion.
Low
dotenv library
dotenv.config();
The example loads all variables from a local environment file into the process. In these wallet workflows, that environment can include private keys.
Low
dotenv library
dotenv.config();
The example loads all variables from a local environment file into the process. In these wallet workflows, that environment can include private keys.
Low
dotenv library
dotenv.config();
The example loads all variables from a local environment file into the process. In these wallet workflows, that environment can include private keys.
Low
dotenv library
import 'dotenv/config'
The example loads all variables from a local environment file into the process. In these wallet workflows, that environment can include private keys.
Low
dotenv library
import 'dotenv/config'
The example loads all variables from a local environment file into the process. In these wallet workflows, that environment can include private keys.
Low
Environment variable access (bracket notation)
for (const key of required) creds[key] = process.env[key];
The code reads named credentials or a wallet private key from the process environment. Environment compromise would expose signing or API authority.
Low
Environment variable access (bracket notation)
const value = process.env[name]?.trim();
The code reads named credentials or a wallet private key from the process environment. Environment compromise would expose signing or API authority.
Low
Environment variable access (dot notation)
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The code accesses a wallet private key through the process environment. Secret exposure would enable unauthorized wallet operations.
Low
Environment variable access (dot notation)
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The code accesses a wallet private key through the process environment. Secret exposure would enable unauthorized wallet operations.
Low
Environment variable access (dot notation)
if (!process.env.PRIVATE_KEY) {
The code accesses a wallet private key through the process environment. Secret exposure would enable unauthorized wallet operations.
Low
Environment variable access (dot notation)
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY, provider);
The code accesses a wallet private key through the process environment. Secret exposure would enable unauthorized wallet operations.
Low
Environment variable object
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The code accesses a wallet private key through the process environment. Secret exposure would enable unauthorized wallet operations.
Low
Environment variable object
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The code accesses a wallet private key through the process environment. Secret exposure would enable unauthorized wallet operations.
Low
Environment variable object
if (!process.env.PRIVATE_KEY) {
The code accesses a wallet private key through the process environment. Secret exposure would enable unauthorized wallet operations.
Low
Environment variable object
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY, provider);
The code accesses a wallet private key through the process environment. Secret exposure would enable unauthorized wallet operations.
Low
Python environment access
1. **Store API keys in environment variables** — never hardcode. Use `process.env.CHAINGPT_API_KEY`
The example reads an API credential from the process environment for authentication. Environment disclosure would expose access to the external service.
Low
Python environment access
'Authorization': f'Bearer {os.environ["NEAR_API_KEY"]}'
The example reads an API credential from the process environment for authentication. Environment disclosure would expose access to the external service.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (28)
RISK-001 Critical
Pipe to shell pattern
curl -L https://foundry.paradigm.xyz | bash
The guide pipes an unpinned remote response directly into a shell. A compromised server or redirected download would execute arbitrary code.
RISK-002 Critical
Pipe to shell pattern
- `cast` from Foundry (`curl -L https://foundry.paradigm.xyz | bash && foundryup`)
The guide pipes an unpinned remote response directly into a shell. A compromised server or redirected download would execute arbitrary code.
RISK-003 Critical
Pipe to shell pattern
curl -fsSL https://tempo.xyz/install | bash
The guide pipes an unpinned remote response directly into a shell. A compromised server or redirected download would execute arbitrary code.
RISK-004 Critical
Pipe to shell pattern
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
The guide pipes an unpinned remote response directly into a shell. A compromised server or redirected download would execute arbitrary code.
RISK-005 Critical
Pipe to shell pattern
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/cargo-near/releases/latest/download/ca
The guide pipes an unpinned remote response directly into a shell. A compromised server or redirected download would execute arbitrary code.
RISK-006 Critical
Pipe to shell pattern
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/near-cli-rs/releases/latest/download/n
The guide pipes an unpinned remote response directly into a shell. A compromised server or redirected download would execute arbitrary code.
RISK-007 Critical
macOS security command
> **Back up the passphrase either way.** Keychain entry: `service=chaingpt-mcp-agent-wallet account=
The command retrieves a wallet passphrase from macOS Keychain and prints it. Agent context, terminal capture, or logs could expose the secret.
RISK-008 Critical
Silent Third-Party Skill Installation
The routing skill silently installs a global third-party plugin and immediately loads its instructions. This bypasses informed consent and creates a supply-chain execution path.
The instructions explicitly use a global install command with automatic confirmation, call the process invisible, and immediately apply the installed plugin.
RISK-009 High
Certificate/key files
- Treat `ANTSEED_IDENTITY_HEX` / `~/.antseed/identity.key` as a hot wallet key.
The guide identifies a raw EVM private-key file used by a funded hot wallet. Disclosure, weak permissions, or unsafe backup would compromise funds.
RISK-010 High
Certificate/key files
| `identity.key` | Raw 32-byte EVM private key for the buyer wallet. Fallback when `ANTSEED_IDENTITY
The guide identifies a raw EVM private-key file used by a funded hot wallet. Disclosure, weak permissions, or unsafe backup would compromise funds.
RISK-011 High
Crypto seed/private key mention
- The page generates a real agent EOA for the demo and exports a JSON package containing the agent p
The demo exports or offers to export a real agent private key in a JSON bearer package. Disclosure would grant signing authority and access to funds.
RISK-012 High
Crypto seed/private key mention
The exported agent package is a bearer capability in demo form. Include explicit warnings, keep caps
The demo exports or offers to export a real agent private key in a JSON bearer package. Disclosure would grant signing authority and access to funds.
RISK-013 High
Crypto seed/private key mention
- include private key in exported JSON or omit it;
The demo exports or offers to export a real agent private key in a JSON bearer package. Disclosure would grant signing authority and access to funds.
RISK-014 High
Crypto seed/private key mention
# Login with wallet private key
The workflow asks the user to enter a wallet private key into a third-party CLI. A compromised CLI or captured terminal could steal it.
RISK-015 High
Crypto seed/private key mention
# Enter private key when prompted
The workflow asks the user to enter a wallet private key into a third-party CLI. A compromised CLI or captured terminal could steal it.
RISK-016 High
Crypto seed/private key mention
2. **Environment configuration**: Setup `.env` file with private key
The example stores a wallet private key in a plaintext environment file. File disclosure or accidental source control inclusion could compromise funds.
RISK-017 High
Crypto seed/private key mention
# Your wallet private key
The example stores a wallet private key in a plaintext environment file. File disclosure or accidental source control inclusion could compromise funds.
RISK-018 High
Crypto seed/private key mention
# Your wallet private key (NEVER commit this file!)
The example stores a wallet private key in a plaintext environment file. File disclosure or accidental source control inclusion could compromise funds.
RISK-019 High
Crypto seed/private key mention
# Your wallet private key
The example stores a wallet private key in a plaintext environment file. File disclosure or accidental source control inclusion could compromise funds.
RISK-020 High
Environment file access
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The example loads a wallet private key from a plaintext environment file or process environment. Secret exposure would permit unauthorized signing.
RISK-021 High
Environment file access
const wallet = new ethers.Wallet(process.env.PRIVATE_KEY!, provider);
The example loads a wallet private key from a plaintext environment file or process environment. Secret exposure would permit unauthorized signing.
RISK-022 High
Environment file access
2. **Environment configuration**: Setup `.env` file with private key
The example loads a wallet private key from a plaintext environment file or process environment. Secret exposure would permit unauthorized signing.
RISK-023 High
Environment file access
Create `.env`:
The example loads a wallet private key from a plaintext environment file or process environment. Secret exposure would permit unauthorized signing.
RISK-024 High
Environment file access
if (!process.env.PRIVATE_KEY) {
The example loads a wallet private key from a plaintext environment file or process environment. Secret exposure would permit unauthorized signing.
RISK-025 High
Automatic External Disclosure of User Context
The skill requires opening a public repository issue and including the user goal and failure details. It does not require user approval or redaction.
The instructions mandate filing the issue directly when a GitHub tool exists and specify that user goals and failures must be included.
RISK-026 High
Untrusted Peer Message Controls Priority Actions
A peer-controlled marker receives highest priority and causes raw message data to be written and passed to a CLI. Sender and job validation are not required.
The routing table explicitly prioritizes a peer marker before other actions and passes the complete untrusted message through a local file to the CLI.
RISK-027 Medium
SQLite database file
| `metering.db` | SQLite log of every request the proxy served (model, peer, tokens, USDC). Used by
The local database retains request, peer, token, and payment history. Backups or weak file permissions could expose operational metadata.
RISK-028 Medium
Untrusted Repository Content Lacks an Instruction Boundary
The workflow clones an escrow-selected repository and directs the agent to read its tests. It does not warn that repository instructions are untrusted data.
The repository URL and commit come from external escrow data, then the agent reads test content without a prompt-injection or trust-boundary safeguard.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalRemote installer responses are piped directly into shells.Download pinned releases, verify checksums or signatures, inspect scripts, and require explicit approval before execution.
- FIX-002CriticalWallet secrets can be printed, exported, passed as arguments, or stored in plaintext files.Use wallet-provider signing, protected secret stores, restrictive permissions, redacted logs, and non-exportable test keys.
- FIX-003CriticalA third-party plugin is installed globally and loaded without visible consent.Show the source, version, hash, permissions, and destination. Require explicit approval before every install or update.
- FIX-004HighLLM-generated Python expressions are executed with eval.Replace eval with a constrained rule schema and an AST interpreter that rejects attributes, calls, imports, and unknown operators.
- FIX-005HighCoverage-gap reporting can publish user goals and failure details automatically.Prepare a redacted issue draft, show the exact content, and require approval before any external submission.
- FIX-006HighUntrusted peer messages and repositories can steer agent actions.Authenticate senders, validate identifiers and schemas, isolate external content, and forbid embedded instructions from changing agent policy.
- FIX-007MediumStatic review cappedManually review the omitted 6508 static analyzer matches or reduce bundled generated/vendor/reference content before enabling automatic publication.
- FIX-008MediumPrivileged commands and predictable temporary paths appear in operational guidance.Require approval for sudo and process termination. Use securely created temporary directories with restrictive permissions and cleanup.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- 3f6e026a3363e0954ede7bef0cfe88d4475de137
- Content hash
- b3bbd91c0da8933660828dc9fc57c7c558662a81bd6f099b34e84c47fc6b995a
- Tree hash
- 370a15e0720f135e57402e9fbddc3af4723c6f041cc94d225f4e1b42b995ec96
- Skill path
- skills/internet-court/internet-court
- Audit payload hash
- f61c3faee9b5ee1e9fc53a2aecd0db0b
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: unavailable