📦
Audit History
kleros-ipfs-upload - 2 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 2 Latest
Jul 19, 2026, 10:42 AM
Most static alerts are false positives caused by Markdown backticks, TypeScript templates, documented URLs, and URL path text. Confirmed risks involve payment credentials, configurable paid endpoints, unpinned dependencies, and public evidence uploads. No prompt injection attempt was found.
4
Files scanned
557
Lines analyzed
41
Review items
0
False positives ignored
Confirmed security concerns (10)
High
Environment file access
if (process.env.CDP_CREDS_PATH && required.some((k) => !creds[k])) {
This condition enables credential loading from the path in CDP_CREDS_PATH. The following line reads sensitive wallet credentials from that file.
High
Environment file access
const fromFile = await loadEnvFile(process.env.CDP_CREDS_PATH);
The script reads the environment-selected file and parses CDP API and wallet secrets. This is direct access to a sensitive credential file.
High
Crypto seed/private key mention
const privateKey = (
This code normalizes the payer private key for signer construction. The value grants authority to authorize USDC payments.
High
Crypto seed/private key mention
const signer = await createSigner("base", privateKey);
The private key is passed to createSigner for Base payments. This is legitimate functionality with direct financial authority.
High
Environment file access
If you'd rather not pass four env vars on the command line, point `CDP_CREDS_PATH` at a `.env`-style
The instructions recommend storing CDP API and wallet secrets in an environment-style file. No restrictive permission requirement is provided.
High
Crypto seed/private key mention
const signer = await createSigner("base", privateKey);
The example creates a Base signer from a private key. Any process following it receives direct access to a spending credential.
High
Crypto seed/private key mention
node -e "import('viem/accounts').then(m => console.log(m.generatePrivateKey()))"
The command generates a private key and prints it to standard output. Agent logs or terminal capture can retain the secret.
High
Payment Terms Are Not Bounded
Both runners accept GATEWAY_URL and pass its challenge to a payment-enabled fetch. They enforce no origin, amount, token, network, or payee limit before signing.
The source shows an environment-controlled endpoint entering wrapFetchWithPayment without script-side validation. The documented wrapper automatically signs the server challenge.
High
No Sensitive Evidence Review
The skill encourages dispute screenshots and documents without requiring a sensitivity review. Uploads go to externally retrievable IPFS and third-party pinning infrastructure.
The documented use cases include evidence files, and the response section provides public gateway URLs. No redaction or confidentiality check is required before upload.
Medium
Unpinned Payment Dependencies
The skill instructs npm install while dependency versions use caret ranges and no lockfile. Future installs can change code that receives wallet credentials and signs payments.
The package manifest contains caret ranges, and SKILL.md explicitly says the lockfile is omitted so versions stay fresh.
Capability review items (26)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
* CDP_API_KEY_ID=... CDP_API_KEY_SECRET=... CDP_WALLET_SECRET=... \
The documented invocation places CDP API and wallet secrets directly in a shell command. Real substitutions can persist in shell history or process inspection.
High
Generic API/secret keys
apiKeyId: creds.CDP_API_KEY_ID!,
The CDP API key identifier is loaded into a client that controls a server wallet. It is part of the credential set used for paid requests.
High
Generic API/secret keys
apiKeySecret: creds.CDP_API_KEY_SECRET!,
The script passes the CDP API secret into the wallet client. Compromise of this runtime or dependency can expose a payment credential.
High
Generic API/secret keys
* EVM_PRIVATE_KEY=0x... npx tsx pay-and-upload.ts ./somefile.txt
The documented invocation places an EVM private key directly in a shell command. A real key can persist in shell history or process inspection.
High
Generic API/secret keys
const rawKey = process.env.EVM_PRIVATE_KEY;
The script directly reads the payer private key and later creates a signer from it. This grants the process authority to authorize USDC payments.
High
Generic API/secret keys
EVM_PRIVATE_KEY=0xYourPayerKey npx tsx pay-and-upload.ts /path/to/file.json
The quickstart instructs users to place a payer private key directly in a shell command. Real keys can be retained in command history.
High
Generic API/secret keys
CDP_API_KEY_SECRET=... \
The command template places the CDP API secret directly on the command line. Replacing the placeholder can expose it through shell history.
High
Generic API/secret keys
If you'd rather not pass four env vars on the command line, point `CDP_CREDS_PATH` at a `.env`-style
The skill recommends a file containing CDP API and wallet secrets without requiring restrictive permissions. Weak file permissions could disclose wallet credentials.
High
Generic API/secret keys
EVM_PRIVATE_KEY=0x... npx tsx pay-and-upload.ts hello-world.txt
The paid smoke-test template places the private key in the command line. A real value can be retained in shell history.
High
Generic API/secret keys
CDP_API_KEY_ID=... CDP_API_KEY_SECRET=... CDP_WALLET_SECRET=... \
The CDP smoke-test template places multiple wallet credentials in one shell command. Real values can leak through history or process inspection.
High
Generic API/secret keys
2. Run the bundled script: `EVM_PRIVATE_KEY=0x... npx tsx pay-and-upload.ts /tmp/exhibit-a.png`.
The evidence-upload example places an EVM private key in an inline command. A real key can be retained in shell history.
High
Generic API/secret keys
1. `OPERATION=meta-evidence EVM_PRIVATE_KEY=0x... npx tsx pay-and-upload.ts ./case-42.json`.
The meta-evidence example places an EVM private key in an inline command. A real key can be retained in shell history.
Low
Hardcoded URL · 2 occurrences
process.env.GATEWAY_URL ?? "https://kleros-ipfs-gateway.fly.dev";
The executable defaults to this external host and later sends file data through a payment-enabled fetch. The network exposure is intentional but real.
Low
Environment variable access (bracket notation)
for (const key of required) creds[key] = process.env[key];
The loop reads named CDP credentials from the process environment. This is required functionality, but it gives the script access to payment secrets.
Low
Environment variable access (dot notation)
if (process.env.CDP_CREDS_PATH && required.some((k) => !creds[k])) {
CDP_CREDS_PATH controls whether the script loads credentials from a local file. A modified environment can redirect secret loading to another readable path.
Low
Environment variable access (dot notation)
const fromFile = await loadEnvFile(process.env.CDP_CREDS_PATH);
The environment value is passed directly to the credential-file loader. This is intentional, but it selects a local file containing payment secrets.
Low
Environment variable access (dot notation) · 2 occurrences
process.env.GATEWAY_URL ?? "https://kleros-ipfs-gateway.fly.dev";
GATEWAY_URL can redirect both the uploaded file and the payment-enabled request. The script does not constrain the configured origin.
Low
Environment variable object
for (const key of required) creds[key] = process.env[key];
The loop reads named CDP credentials from the process environment. This is required functionality, but it gives the script access to payment secrets.
Low
Environment variable object
if (process.env.CDP_CREDS_PATH && required.some((k) => !creds[k])) {
CDP_CREDS_PATH controls whether the script loads credentials from a local file. A modified environment can redirect secret loading to another readable path.
Low
Environment variable object
const fromFile = await loadEnvFile(process.env.CDP_CREDS_PATH);
The environment value is passed directly to the credential-file loader. This is intentional, but it selects a local file containing payment secrets.
Low
Environment variable object · 2 occurrences
process.env.GATEWAY_URL ?? "https://kleros-ipfs-gateway.fly.dev";
GATEWAY_URL can redirect both the uploaded file and the payment-enabled request. The script does not constrain the configured origin.
Low
Environment variable access (dot notation)
const rawKey = process.env.EVM_PRIVATE_KEY;
The script reads EVM_PRIVATE_KEY from the environment and later uses it to create a payment signer. This is direct access to a spending credential.
Low
Environment variable object
const rawKey = process.env.EVM_PRIVATE_KEY;
The script reads EVM_PRIVATE_KEY from the environment and later uses it to create a payment signer. This is direct access to a spending credential.
Risk Factors
⚙️ External commands (50)
scripts/pay-and-upload-cdp.ts:7 scripts/pay-and-upload-cdp.ts:8 scripts/pay-and-upload-cdp.ts:82 scripts/pay-and-upload-cdp.ts:99 scripts/pay-and-upload-cdp.ts:113 scripts/pay-and-upload-cdp.ts:118 scripts/pay-and-upload-cdp.ts:131-133 scripts/pay-and-upload-cdp.ts:134 scripts/pay-and-upload-cdp.ts:138 scripts/pay-and-upload-cdp.ts:154 scripts/pay-and-upload-cdp.ts:158 scripts/pay-and-upload-cdp.ts:32 scripts/pay-and-upload-cdp.ts:8-82 scripts/pay-and-upload.ts:38 scripts/pay-and-upload.ts:39 scripts/pay-and-upload.ts:56-58 scripts/pay-and-upload.ts:59 scripts/pay-and-upload.ts:65 scripts/pay-and-upload.ts:66 scripts/pay-and-upload.ts:79 scripts/pay-and-upload.ts:83 SKILL.md:17 SKILL.md:31 SKILL.md:46 SKILL.md:47 SKILL.md:49-53 SKILL.md:53-55 SKILL.md:55 SKILL.md:57-59 SKILL.md:59 SKILL.md:63-74 SKILL.md:74-75 SKILL.md:75-78 SKILL.md:78-80 SKILL.md:80 SKILL.md:84-86 SKILL.md:86-99 SKILL.md:99-105 SKILL.md:105-115 SKILL.md:115-117 SKILL.md:117-119 SKILL.md:119-123 SKILL.md:123 SKILL.md:125 SKILL.md:127-135 SKILL.md:135-137 SKILL.md:137-139 SKILL.md:139 SKILL.md:143-151 SKILL.md:151-157
🌐 Network access (18)
🔑 Env variables (40)
scripts/pay-and-upload-cdp.ts:66 scripts/pay-and-upload-cdp.ts:68 scripts/pay-and-upload-cdp.ts:69 scripts/pay-and-upload-cdp.ts:89 scripts/pay-and-upload-cdp.ts:90 scripts/pay-and-upload-cdp.ts:66 scripts/pay-and-upload-cdp.ts:68 scripts/pay-and-upload-cdp.ts:69 scripts/pay-and-upload-cdp.ts:89 scripts/pay-and-upload-cdp.ts:90 scripts/pay-and-upload-cdp.ts:16 scripts/pay-and-upload-cdp.ts:20 scripts/pay-and-upload-cdp.ts:21 scripts/pay-and-upload-cdp.ts:59 scripts/pay-and-upload-cdp.ts:60 scripts/pay-and-upload-cdp.ts:72 scripts/pay-and-upload-cdp.ts:73 scripts/pay-and-upload-cdp.ts:93 scripts/pay-and-upload-cdp.ts:94 scripts/pay-and-upload.ts:32 scripts/pay-and-upload.ts:42 scripts/pay-and-upload.ts:43 scripts/pay-and-upload.ts:32 scripts/pay-and-upload.ts:42 scripts/pay-and-upload.ts:43 scripts/pay-and-upload.ts:11 scripts/pay-and-upload.ts:14 scripts/pay-and-upload.ts:32 scripts/pay-and-upload.ts:34 SKILL.md:66 SKILL.md:66 SKILL.md:52 SKILL.md:119 SKILL.md:130 SKILL.md:131 SKILL.md:139 SKILL.md:240 SKILL.md:243 SKILL.md:266 SKILL.md:274
⚡ Contains scripts (1)
📁 Filesystem access (11)
Audited by: codex
Jul 9, 2026, 11:33 PM
This skill has a legitimate Kleros IPFS upload purpose, but it is high risk. It sends local files to an external gateway and signs real Base mainnet USDC payments. Most Markdown backtick findings are false positives, but credential handling, .env loading, configurable endpoints, paid execution, and fresh dependency installation remain confirmed concerns.
4
Files scanned
548
Lines analyzed
86
Review items
0
False positives ignored
Confirmed security concerns (23)
High
Environment file access
* CDP_CREDS_PATH Optional. Path to a .env-style file containing any of
The line loads or documents credential-bearing environment variables or .env-style files. This is sensitive because the credentials authorize paid uploads or CDP account access.
High
Environment file access
for (const key of required) creds[key] = process.env[key];
The line loads or documents credential-bearing environment variables or .env-style files. This is sensitive because the credentials authorize paid uploads or CDP account access.
High
Environment file access
if (process.env.CDP_CREDS_PATH && required.some((k) => !creds[k])) {
The line loads or documents credential-bearing environment variables or .env-style files. This is sensitive because the credentials authorize paid uploads or CDP account access.
High
Environment file access
const fromFile = await loadEnvFile(process.env.CDP_CREDS_PATH);
The line loads or documents credential-bearing environment variables or .env-style files. This is sensitive because the credentials authorize paid uploads or CDP account access.
High
Environment file access
`${key} is required (set in env, or in a CDP_CREDS_PATH .env file)`
The line loads or documents credential-bearing environment variables or .env-style files. This is sensitive because the credentials authorize paid uploads or CDP account access.
High
Environment file access
process.env.GATEWAY_URL ?? "https://kleros-ipfs-gateway.fly.dev";
The line loads or documents credential-bearing environment variables or .env-style files. This is sensitive because the credentials authorize paid uploads or CDP account access.
High
Environment file access
const operation = process.env.OPERATION ?? "evidence";
The line loads or documents credential-bearing environment variables or .env-style files. This is sensitive because the credentials authorize paid uploads or CDP account access.
High
Crypto seed/private key mention
* CDP server account instead of an exported EVM private key. Intended for
The skill handles wallet private keys or CDP signing credentials for Base mainnet payments. These secrets can authorize spending if exposed or reused unsafely.
High
Crypto seed/private key mention
* hosted agents (OpenClaw, server-side workers) where exporting a private key
The skill handles wallet private keys or CDP signing credentials for Base mainnet payments. These secrets can authorize spending if exposed or reused unsafely.
High
Environment file access
const rawKey = process.env.EVM_PRIVATE_KEY;
The line loads or documents credential-bearing environment variables or .env-style files. This is sensitive because the credentials authorize paid uploads or CDP account access.
High
Environment file access
process.env.GATEWAY_URL ?? "https://kleros-ipfs-gateway.fly.dev";
The line loads or documents credential-bearing environment variables or .env-style files. This is sensitive because the credentials authorize paid uploads or CDP account access.
High
Environment file access
const operation = process.env.OPERATION ?? "evidence";
The line loads or documents credential-bearing environment variables or .env-style files. This is sensitive because the credentials authorize paid uploads or CDP account access.
High
Crypto seed/private key mention
* EVM_PRIVATE_KEY payer's Base mainnet private key (required)
The skill handles wallet private keys or CDP signing credentials for Base mainnet payments. These secrets can authorize spending if exposed or reused unsafely.
High
Crypto seed/private key mention
const privateKey = (
The skill handles wallet private keys or CDP signing credentials for Base mainnet payments. These secrets can authorize spending if exposed or reused unsafely.
High
Crypto seed/private key mention
const signer = await createSigner("base", privateKey);
The skill handles wallet private keys or CDP signing credentials for Base mainnet payments. These secrets can authorize spending if exposed or reused unsafely.
High
Environment file access
const operation = process.env.OPERATION ?? "evidence";
The line loads or documents credential-bearing environment variables or .env-style files. This is sensitive because the credentials authorize paid uploads or CDP account access.
High
Environment file access
If you'd rather not pass four env vars on the command line, point `CDP_CREDS_PATH` at a `.env`-style
The line loads or documents credential-bearing environment variables or .env-style files. This is sensitive because the credentials authorize paid uploads or CDP account access.
High
Crypto seed/private key mention
const signer = await createSigner("base", privateKey);
The skill handles wallet private keys or CDP signing credentials for Base mainnet payments. These secrets can authorize spending if exposed or reused unsafely.
High
Crypto seed/private key mention
node -e "import('viem/accounts').then(m => console.log(m.generatePrivateKey()))"
The skill handles wallet private keys or CDP signing credentials for Base mainnet payments. These secrets can authorize spending if exposed or reused unsafely.
High
Crypto seed/private key mention
Hosted agents (OpenClaw, server-side workers, anything running with Coinbase CDP credentials) don't
The skill handles wallet private keys or CDP signing credentials for Base mainnet payments. These secrets can authorize spending if exposed or reused unsafely.
High
Remote Upload of Arbitrary Local Files
Both runners accept a local path, read the file bytes, and post them to the Kleros gateway. If an agent selects the wrong path, local data can be disclosed and pinned externally.
The scripts read process.argv file paths and send the file contents through fetchWithPay. This directly combines local file access with external network upload.
High
Paid Mainnet Transaction Side Effect
The skill intentionally spends real USDC on Base mainnet for successful uploads and paid smoke tests. Automatic execution could spend funds without clear user approval.
The documentation and script comments explicitly state that each successful upload costs USDC on Base mainnet. This is a clear financial side effect.
Medium
Fresh Dependency Installation Before Credential Use
The documentation instructs agents to run npm install and then execute the bundled runner, while noting there is no committed lockfile. Fresh dependency resolution increases supply-chain risk before handling payment credentials.
The skill explicitly says to install dependencies at use time and states that dependency versions stay fresh without a lockfile. This is legitimate but risky when wallet or CDP secrets are present.
Capability review items (58)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Environment variable access (bracket notation)
for (const key of required) creds[key] = process.env[key];
This environment access is part of loading CDP or wallet credentials, including optional .env-style credential files. Mishandling those values can expose payment authority.
High
Environment variable access (dot notation)
if (process.env.CDP_CREDS_PATH && required.some((k) => !creds[k])) {
This environment access is part of loading CDP or wallet credentials, including optional .env-style credential files. Mishandling those values can expose payment authority.
High
Environment variable access (dot notation)
const fromFile = await loadEnvFile(process.env.CDP_CREDS_PATH);
This environment access is part of loading CDP or wallet credentials, including optional .env-style credential files. Mishandling those values can expose payment authority.
High
Environment variable object
for (const key of required) creds[key] = process.env[key];
This environment access is part of loading CDP or wallet credentials, including optional .env-style credential files. Mishandling those values can expose payment authority.
High
Environment variable object
if (process.env.CDP_CREDS_PATH && required.some((k) => !creds[k])) {
This environment access is part of loading CDP or wallet credentials, including optional .env-style credential files. Mishandling those values can expose payment authority.
High
Environment variable object
const fromFile = await loadEnvFile(process.env.CDP_CREDS_PATH);
This environment access is part of loading CDP or wallet credentials, including optional .env-style credential files. Mishandling those values can expose payment authority.
High
Generic API/secret keys
* CDP_API_KEY_ID=... CDP_API_KEY_SECRET=... CDP_WALLET_SECRET=... \
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Generic API/secret keys
* CDP_API_KEY_ID CDP API key ID (required)
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Generic API/secret keys
* CDP_API_KEY_SECRET CDP API key secret (required)
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Generic API/secret keys
"CDP_API_KEY_ID",
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Generic API/secret keys
"CDP_API_KEY_SECRET",
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Generic API/secret keys
// Tolerate either the bare key (CDP_API_KEY_ID) or the un-prefixed form
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Generic API/secret keys
// used in some CDP cred bundles (API_KEY_ID).
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Generic API/secret keys
apiKeyId: creds.CDP_API_KEY_ID!,
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Generic API/secret keys
apiKeySecret: creds.CDP_API_KEY_SECRET!,
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Environment variable access (dot notation)
const rawKey = process.env.EVM_PRIVATE_KEY;
This environment access is part of loading CDP or wallet credentials, including optional .env-style credential files. Mishandling those values can expose payment authority.
High
Environment variable object
const rawKey = process.env.EVM_PRIVATE_KEY;
This environment access is part of loading CDP or wallet credentials, including optional .env-style credential files. Mishandling those values can expose payment authority.
High
Generic API/secret keys
* EVM_PRIVATE_KEY=0x... npx tsx pay-and-upload.ts ./somefile.txt
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Generic API/secret keys
* EVM_PRIVATE_KEY payer's Base mainnet private key (required)
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Generic API/secret keys
const rawKey = process.env.EVM_PRIVATE_KEY;
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Generic API/secret keys
console.error("EVM_PRIVATE_KEY env var is required");
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Path traversal sequence
**Something broken or confusing in this skill?** Report it: fetch [feedback/SKILL.md](../feedback/SK
The Markdown link points outside the skill directory with ../feedback/SKILL.md. Even as documentation, it can direct an agent to load unreviewed sibling content beyond the skill boundary.
High
Generic API/secret keys
EVM_PRIVATE_KEY=0xYourPayerKey npx tsx pay-and-upload.ts /path/to/file.json
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Generic API/secret keys
3. **Store the key in `EVM_PRIVATE_KEY`**.
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Generic API/secret keys
CDP_API_KEY_ID=... \
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Generic API/secret keys
CDP_API_KEY_SECRET=... \
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Generic API/secret keys
If you'd rather not pass four env vars on the command line, point `CDP_CREDS_PATH` at a `.env`-style
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Generic API/secret keys
EVM_PRIVATE_KEY=0x... npx tsx pay-and-upload.ts hello-world.txt
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Generic API/secret keys
CDP_API_KEY_ID=... CDP_API_KEY_SECRET=... CDP_WALLET_SECRET=... \
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Generic API/secret keys
2. Run the bundled script: `EVM_PRIVATE_KEY=0x... npx tsx pay-and-upload.ts /tmp/exhibit-a.png`.
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
High
Generic API/secret keys
1. `OPERATION=meta-evidence EVM_PRIVATE_KEY=0x... npx tsx pay-and-upload.ts ./case-42.json`.
The skill documents or reads wallet private keys, CDP API keys, or CDP wallet secrets. These credentials can authorize payments or account access if mishandled.
Medium
Hardcoded URL · 2 occurrences
* GATEWAY_URL defaults to https://kleros-ipfs-gateway.fly.dev
The hardcoded Kleros gateway or CDN is an intentional external network dependency. Uploads and checks leave the local workspace, so users need consent and availability awareness.
Medium
Hardcoded URL · 2 occurrences
process.env.GATEWAY_URL ?? "https://kleros-ipfs-gateway.fly.dev";
The hardcoded Kleros gateway or CDN is an intentional external network dependency. Uploads and checks leave the local workspace, so users need consent and availability awareness.
Medium
Environment variable access (dot notation) · 2 occurrences
process.env.GATEWAY_URL ?? "https://kleros-ipfs-gateway.fly.dev";
GATEWAY_URL is a non-secret configuration value, but it controls the remote upload endpoint. A bad environment value could redirect file uploads away from the intended Kleros gateway.
Medium
Environment variable object · 2 occurrences
process.env.GATEWAY_URL ?? "https://kleros-ipfs-gateway.fly.dev";
GATEWAY_URL is a non-secret configuration value, but it controls the remote upload endpoint. A bad environment value could redirect file uploads away from the intended Kleros gateway.
Medium
Dynamic import() expression
node -e "import('viem/accounts').then(m => console.log(m.generatePrivateKey()))"
The documentation tells agents to run a node -e command that dynamically imports viem/accounts to generate a key. It is a legitimate setup step, but it executes local Node dependency code.
Medium
Shell command substitution
On success the script prints each CID on its own line (so you can capture them with `$(npx tsx pay-a
The documentation recommends shell command substitution around npx tsx, which executes the bundled upload script and can spend funds when credentials are present. This is a real external command instruction in the skill text.
Medium
Shell command substitution
test "$(stat -f%z /path/to/file)" -le 4194304 || echo "too big for the Kleros gateway"
The size check uses local shell command substitution with stat. The command is limited and defensive, but it still instructs agents to execute a shell command on a file path.
Medium
Shell command substitution
echo "kleros gateway smoke test $(date -u +%Y-%m-%dT%H:%M:%SZ)" > hello-world.txt
The smoke test creates a file using shell command substitution with date. The behavior is benign, but it is still an executable shell instruction in the skill workflow.
Medium
Template literal with command substitution
On success the script prints each CID on its own line (so you can capture them with `$(npx tsx pay-a
The line documents capture of a shell command result from the paid upload runner. It is Markdown, but following it executes local tooling and therefore remains a real operational risk.
Medium
Hardcoded URL
Upload Kleros-ecosystem files to IPFS via `https://kleros-ipfs-gateway.fly.dev/upload-to-ipfs`, an x
The hardcoded Kleros gateway or CDN is an intentional external network dependency. Uploads and checks leave the local workspace, so users need consent and availability awareness.
Medium
Hardcoded URL
Defaults: `OPERATION=evidence`, `GATEWAY_URL=https://kleros-ipfs-gateway.fly.dev`. Override `OPERATI
The hardcoded Kleros gateway or CDN is an intentional external network dependency. Uploads and checks leave the local workspace, so users need consent and availability awareness.
Medium
Hardcoded URL
const url = `https://kleros-ipfs-gateway.fly.dev/upload-to-ipfs` +
The hardcoded Kleros gateway or CDN is an intentional external network dependency. Uploads and checks leave the local workspace, so users need consent and availability awareness.
Medium
Hardcoded URL
curl -sS https://kleros-ipfs-gateway.fly.dev/health
The hardcoded Kleros gateway or CDN is an intentional external network dependency. Uploads and checks leave the local workspace, so users need consent and availability awareness.
Medium
Hardcoded URL
curl -sS https://kleros-ipfs-gateway.fly.dev/.well-known/x402 | jq .
The hardcoded Kleros gateway or CDN is an intentional external network dependency. Uploads and checks leave the local workspace, so users need consent and availability awareness.
Medium
Hardcoded URL
curl -sS -X POST https://kleros-ipfs-gateway.fly.dev/upload-to-ipfs?operation=evidence \
The hardcoded Kleros gateway or CDN is an intentional external network dependency. Uploads and checks leave the local workspace, so users need consent and availability awareness.
Medium
Hardcoded URL
- `GET https://kleros-ipfs-gateway.fly.dev/.well-known/x402`
The hardcoded Kleros gateway or CDN is an intentional external network dependency. Uploads and checks leave the local workspace, so users need consent and availability awareness.
Medium
Hardcoded URL
- `GET https://kleros-ipfs-gateway.fly.dev/discovery/resources`
The hardcoded Kleros gateway or CDN is an intentional external network dependency. Uploads and checks leave the local workspace, so users need consent and availability awareness.
Low
Hardcoded URL
"urls": ["https://cdn.kleros.link/ipfs/QmXXX..."],
The hardcoded Kleros gateway or CDN is an intentional external network dependency. Uploads and checks leave the local workspace, so users need consent and availability awareness.
Low
Hardcoded URL
- **Prefer `urls[i]`** — the gateway pre-builds a ready-to-use HTTP URL using the canonical Kleros I
The hardcoded Kleros gateway or CDN is an intentional external network dependency. Uploads and checks leave the local workspace, so users need consent and availability awareness.
Low
Hardcoded URL
| Kleros HTTP gateway URL | `"https://cdn.kleros.link" + cid` (or just use `urls[i]`) |
The hardcoded Kleros gateway or CDN is an intentional external network dependency. Uploads and checks leave the local workspace, so users need consent and availability awareness.
Low
Hardcoded URL
Do **not** write `https://cdn.kleros.link/ipfs/${cid}` — that produces a double-slash path because `
The hardcoded Kleros gateway or CDN is an intentional external network dependency. Uploads and checks leave the local workspace, so users need consent and availability awareness.
Low
Hardcoded URL
curl -sS https://cdn.kleros.link/ipfs/QmAbc... # paste the bare CID
The hardcoded Kleros gateway or CDN is an intentional external network dependency. Uploads and checks leave the local workspace, so users need consent and availability awareness.
Low
Hardcoded URL
3. The script prints the CID on stdout (e.g. `/ipfs/QmXXX...`) and the pre-built URL on stderr as `u
The hardcoded Kleros gateway or CDN is an intentional external network dependency. Uploads and checks leave the local workspace, so users need consent and availability awareness.
Risk Factors
⚙️ External commands (50)
scripts/pay-and-upload-cdp.ts:7 scripts/pay-and-upload-cdp.ts:8 scripts/pay-and-upload-cdp.ts:82 scripts/pay-and-upload-cdp.ts:99 scripts/pay-and-upload-cdp.ts:113 scripts/pay-and-upload-cdp.ts:118 scripts/pay-and-upload-cdp.ts:131-133 scripts/pay-and-upload-cdp.ts:134 scripts/pay-and-upload-cdp.ts:138 scripts/pay-and-upload-cdp.ts:154 scripts/pay-and-upload-cdp.ts:158 scripts/pay-and-upload-cdp.ts:32 scripts/pay-and-upload-cdp.ts:8-82 scripts/pay-and-upload.ts:38 scripts/pay-and-upload.ts:39 scripts/pay-and-upload.ts:56-58 scripts/pay-and-upload.ts:59 scripts/pay-and-upload.ts:65 scripts/pay-and-upload.ts:66 scripts/pay-and-upload.ts:79 scripts/pay-and-upload.ts:83 SKILL.md:8 SKILL.md:22 SKILL.md:37 SKILL.md:38 SKILL.md:40-44 SKILL.md:44-46 SKILL.md:46 SKILL.md:48-50 SKILL.md:50 SKILL.md:54-65 SKILL.md:65-66 SKILL.md:66-69 SKILL.md:69-71 SKILL.md:71 SKILL.md:75-77 SKILL.md:77-90 SKILL.md:90-96 SKILL.md:96-106 SKILL.md:106-108 SKILL.md:108-110 SKILL.md:110-114 SKILL.md:114 SKILL.md:116 SKILL.md:118-126 SKILL.md:126-128 SKILL.md:128-130 SKILL.md:130 SKILL.md:134-142 SKILL.md:142-148
🌐 Network access (18)
🔑 Env variables (40)
scripts/pay-and-upload-cdp.ts:66 scripts/pay-and-upload-cdp.ts:68 scripts/pay-and-upload-cdp.ts:69 scripts/pay-and-upload-cdp.ts:89 scripts/pay-and-upload-cdp.ts:90 scripts/pay-and-upload-cdp.ts:66 scripts/pay-and-upload-cdp.ts:68 scripts/pay-and-upload-cdp.ts:69 scripts/pay-and-upload-cdp.ts:89 scripts/pay-and-upload-cdp.ts:90 scripts/pay-and-upload-cdp.ts:16 scripts/pay-and-upload-cdp.ts:20 scripts/pay-and-upload-cdp.ts:21 scripts/pay-and-upload-cdp.ts:59 scripts/pay-and-upload-cdp.ts:60 scripts/pay-and-upload-cdp.ts:72 scripts/pay-and-upload-cdp.ts:73 scripts/pay-and-upload-cdp.ts:93 scripts/pay-and-upload-cdp.ts:94 scripts/pay-and-upload.ts:32 scripts/pay-and-upload.ts:42 scripts/pay-and-upload.ts:43 scripts/pay-and-upload.ts:32 scripts/pay-and-upload.ts:42 scripts/pay-and-upload.ts:43 scripts/pay-and-upload.ts:11 scripts/pay-and-upload.ts:14 scripts/pay-and-upload.ts:32 scripts/pay-and-upload.ts:34 SKILL.md:57 SKILL.md:57 SKILL.md:43 SKILL.md:110 SKILL.md:121 SKILL.md:122 SKILL.md:130 SKILL.md:231 SKILL.md:234 SKILL.md:257 SKILL.md:265
⚡ Contains scripts (1)
📁 Filesystem access (12)
Audited by: codex