Skills kleros-curate

📦

kleros-curate

Name: kleros-curate
Author: internet-court

Content revision r1 High Risk 🌐 Network access📁 Filesystem access⚙️ External commands

Manage Kleros Curate Registries

Kleros Curate workflows require exact policy metadata, schemas, deposits, and chain-specific contract steps. This skill gives Claude, Codex, and Claude Code a structured process for safe registry preparation and review.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "kleros-curate" from https://skillstore.io/skills/internet-court-kleros-curate.md and its manifest at https://skillstore.io/api/skills/internet-court-kleros-curate/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/internet-court-kleros-curate.md Signed manifest GET /api/skills/internet-court-kleros-curate/manifest Signed lockfile GET /api/skills/internet-court-kleros-curate/lockfile

Test it

Using "kleros-curate". I want to add a token to the Scout token registry.

Expected outcome:

The skill identifies Scout on Gnosis and uses the Scout overlay plus Light Curate workflow.
It lists the token logo, website, address, symbol, decimals, policy, IPFS, and deposit checks.
It asks for approval before any upload or transaction step.

Using "kleros-curate". Can I challenge this address tag submission?

Expected outcome:

The skill fetches the current policy and registry state before making a recommendation.
It separates policy evidence from unsupported claims and estimates the live challenge deposit.
It prepares an evidence checklist for the user to approve.

Using "kleros-curate". Help me deploy a registry for verified project profiles.

Expected outcome:

The skill outlines policy, MetaEvidence, schema, logo, factory, arbitrator, deposit, and simulation requirements.
It flags missing production metadata before upload.
It explains that frontend visibility requires a separate list-of-lists submission.

Security Audit

High Risk

v2 • 7/19/2026 Open versioned report

Of 110 static findings, 109 are documentation or Markdown false positives. One relative link crosses the skill boundary, and semantic review found missing prompt isolation plus inconsistent approval gates for onchain actions. No prompt injection text was found in the packaged files.

Files scanned

2,354

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

references/shared-metaevidence.md:65-84 references/light-curate.md:70-72 references/shared-item-json.md:197-205

Untrusted Registry Content Lacks Prompt Isolation

Registry-controlled MetaEvidence, policies, and item documents enter agent context without rules that treat embedded text only as data. Malicious documents could influence later wallet actions.

Multiple workflows fetch and read registry-controlled IPFS content, while no rule isolates that content from agent instructions.

High

references/light-curate.md:84-103 references/light-curate.md:120-130 references/stake-curate.md:454-460 references/verify-your-list.md:78-85

Inconsistent Approval Gates for Onchain Actions

Removal, challenge, and appeal workflows direct payable or state-changing calls after simulation without a uniform explicit approval checkpoint. Exact transaction details may remain unapproved.

Payable challenge and appeal steps move directly from simulation to calls; only the separate visibility workflow mandates explicit final approval.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:229

Path traversal sequence

**Something broken or confusing in this skill?** Report it: fetch [feedback/SKILL.md](../feedback/SK

The feedback link loads ../feedback/SKILL.md outside this skill boundary, allowing adjacent unreviewed skill content to enter the agent context.

Risk Factors

🌐 Network access (8)

references/scout-registries.md:120 references/scout-registries.md:176 references/scout-registries.md:249 references/shared-ipfs-upload.md:20 references/shared-ipfs-upload.md:53 references/shared-ipfs-upload.md:54 references/shared-metaevidence.md:70 references/shared-metaevidence.md:71

📁 Filesystem access (7)

references/scout-registries.md:249 references/shared-ipfs-upload.md:44 references/shared-ipfs-upload.md:53 references/shared-ipfs-upload.md:54 references/shared-metaevidence.md:70 references/stake-curate.md:86 SKILL.md:229

⚙️ External commands (50)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/internet-court-kleros-curate/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/internet-court-kleros-curate/security.svg)](https://skillstore.io/skills/internet-court-kleros-curate?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/internet-court-kleros-curate?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-kleros-curate/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/internet-court-kleros-curate.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

internet-court. (2026). kleros-curate security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/internet-court-kleros-curate/audits/2

BibTeX citation

@techreport{internet-court-internet-court-kleros-curate-2026,
  author = {internet-court},
  title = {kleros-curate security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/internet-court-kleros-curate/audits/2},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "kleros-curate security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
  - name: "internet-court"
date-released: "2026-07-19"
url: "https://skillstore.io/skills/internet-court-kleros-curate/audits/2"
identifiers:
  - type: other
    value: "skillstore:internet-court-kleros-curate:audit:2"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Submit a Registry Item

Prepare item metadata, validate schema fields, upload artifacts, and calculate the required transaction value.

Challenge a Bad Entry

Review policy rules, prepare evidence, compute challenge deposits, and outline the challenge transaction.

Launch a Public Registry

Prepare MetaEvidence, policy files, constructor parameters, deployment checks, and frontend verification steps.

Try These Prompts

Identify the Curate Flavor

I have a Kleros Curate registry task. Help me identify whether it uses Light Curate, Stake Curate, or Scout.

Prepare an Item Submission

Help me submit an item to this Curate registry. Fetch the current MetaEvidence, validate the schema, and list each required value.

Review a Challenge

Review this Curate item against the current policy. Tell me whether a challenge is justified and what evidence is needed.

Plan a Registry Deployment

Plan a new Kleros Curate registry deployment. Check MetaEvidence requirements, deposits, arbitrator settings, IPFS artifacts, and verification steps.

Best Practices

Fetch live onchain state before computing deposits, fees, appeal windows, or MetaEvidence references.
Copy MetaEvidence columns exactly and change only the item values required by the registry.
Ask for explicit user approval before upload, challenge, deployment, or transaction submission.

Avoid

Do not estimate deposits, schema fields, chain addresses, or challenge periods from memory.
Do not submit placeholder JSON, malformed MetaEvidence, or inaccessible policy documents.
Do not use generic IPFS uploads for Curate artifacts without explaining durability risks.