Skills make-git-escrow
📦

make-git-escrow

v1.0 Content revision r1 High Risk ⚙️ External commands🌐 Network access🔑 Env variables

Create Git Escrow Bounties

Creating a blockchain escrow bounty needs exact repository, commit, token, and contract details. This skill guides setup and runs git-escrows submit with those parameters.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "make-git-escrow" from https://skillstore.io/skills/internet-court-make-git-escrow.md and its manifest at https://skillstore.io/api/skills/internet-court-make-git-escrow/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/internet-court-make-git-escrow.md Signed manifest GET /api/skills/internet-court-make-git-escrow/manifest Signed lockfile GET /api/skills/internet-court-make-git-escrow/lockfile

Test it

Using "make-git-escrow". Create a bounty for the current repository and use the latest commit.

Expected outcome:

The skill checks the CLI, finds the current remote and commit, asks for reward and contract values, then prepares a final submission review.

Using "make-git-escrow". I have a test repository, commit hash, token address, oracle, arbiter, and reward amount.

Expected outcome:

The skill validates that required values are present, submits the escrow request after approval, and reports the resulting escrow UID.

Using "make-git-escrow". The submit command failed because my wallet has too little balance.

Expected outcome:

The skill helps diagnose likely causes such as gas balance, token approval, network mismatch, or incorrect contract addresses.

Security Audit

High Risk
v2 • 7/21/2026 Open versioned report

The skill legitimately automates blockchain escrow creation, but it invokes third-party CLI commands and handles a private key. Several static matches are documentation-only false positives; confirmed findings cover secret configuration, command-line private-key exposure, and value-bearing escrow actions. Publication should require safeguards for secrets, package execution, and explicit transaction confirmation.

1
Files scanned
91
Lines analyzed
8
Review items
0
False positives ignored

Confirmed security concerns (2)

High
SKILL.md:33
Crypto seed/private key mention
git-escrows new-client --privateKey "0x..." --network "sepolia"
The new-client example places a private key on a command line. Command-line secrets can leak through shell history, process listings, or logs.
High
SKILL.md:65-77
Irreversible Token Escrow Submission
The skill directs the user to submit a bounty that locks token rewards in an escrow. It does not require an explicit final confirmation after displaying the transaction network, token, amount, and contract addresses.
The workflow explicitly gathers a reward and then submits the escrow through the CLI. This is a value-bearing blockchain action, and the supplied workflow lacks a final confirmation checkpoint.
Capability review items (8)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
SKILL.md:4
Generic API/secret keys
compatibility: Requires git-escrows CLI, a configured .env with PRIVATE_KEY, and network access to a
The skill requires a configured PRIVATE_KEY for blockchain transactions. Private-key access is security-sensitive because it controls funds.
High
SKILL.md:36
Generic API/secret keys
Verify it contains at least `PRIVATE_KEY` and `NETWORK` (or defaults to anvil). For base-sepolia and
The workflow directs verification of PRIVATE_KEY and network configuration. Reading secret-bearing configuration requires strict non-disclosure controls.
Medium
SKILL.md:23
Ruby/shell backtick execution
You are automating the creation of a git escrow bounty via the `git-escrows submit` CLI command. Thi
The workflow directs the agent to automate git-escrows CLI commands that can create a funded blockchain escrow. This is an external, value-bearing action and needs explicit confirmation.
Medium
SKILL.md:27
Ruby/shell backtick execution
Run `git-escrows --help` to verify the CLI is installed. If it fails, try `npx git-escrows --help` o
It executes the git-escrows CLI and may fall back to npx or bunx. Package execution can run third-party code and should be pinned and confirmed.
Medium
SKILL.md:32-34
Ruby/shell backtick execution
```
The documented new-client command can create or configure a blockchain client using a private key. It is an external command with security-sensitive effects.
Medium
SKILL.md:36
Ruby/shell backtick execution
Verify it contains at least `PRIVATE_KEY` and `NETWORK` (or defaults to anvil). For base-sepolia and
The workflow instructs inspection of configuration containing a private key. Secret-bearing environment data requires guarded handling and must never be exposed.
Medium
SKILL.md:69-77
Ruby/shell backtick execution
```
The submit command sends user-provided repository, contract, and reward parameters to the git-escrows CLI. It can initiate a token-locking transaction and must be confirmed.
Medium
SKILL.md:85-87
Ruby/shell backtick execution
```
The skill provides a CLI fulfillment command that can perform an external escrow workflow. It should be run only after the user reviews its target and result.

Risk Factors

⚙️ External commands (18)
SKILL.md:23 SKILL.md:27 SKILL.md:31 SKILL.md:32-34 SKILL.md:34-36 SKILL.md:36 SKILL.md:42-47 SKILL.md:47-48 SKILL.md:48-51 SKILL.md:51-54 SKILL.md:54-55 SKILL.md:55-57 SKILL.md:57-60 SKILL.md:60-69 SKILL.md:69-77 SKILL.md:77-85 SKILL.md:85-87 SKILL.md:87-88
🌐 Network access (1)
SKILL.md:17
🔑 Env variables (3)
SKILL.md:4 SKILL.md:16 SKILL.md:36
Audited by: claude View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/internet-court-make-git-escrow/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/internet-court-make-git-escrow/security.svg)](https://skillstore.io/skills/internet-court-make-git-escrow?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/internet-court-make-git-escrow?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-make-git-escrow/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/internet-court-make-git-escrow.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

internet-court. (2026). make-git-escrow security audit report (audit version 2) [Author version 1.0]. Skillstore. https://skillstore.io/skills/internet-court-make-git-escrow/audits/2

BibTeX citation

@techreport{internet-court-internet-court-make-git-escrow-2026, author = {internet-court}, title = {make-git-escrow security audit report (audit version 2)}, institution = {Skillstore}, year = {2026}, number = {2}, url = {https://skillstore.io/skills/internet-court-make-git-escrow/audits/2}, note = {Author version 1.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "make-git-escrow security audit report (audit version 2)" version: "1.0" type: report authors: - name: "internet-court" date-released: "2026-07-21" url: "https://skillstore.io/skills/internet-court-make-git-escrow/audits/2" identifiers: - type: other value: "skillstore:internet-court-make-git-escrow:audit:2" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
65
Community
83
Spec Compliance

What You Can Build

Fund a Test-Fixing Challenge

Create an escrow bounty for a failing test suite so solvers can compete for an ERC20 reward.

Package a Reproducible Bug Bounty

Attach a repository URL and commit hash to a reward so the challenge has a stable target.

Prepare Solver Instructions

After submission, share the escrow UID and fulfillment guidance with developers who will submit solutions.

Try These Prompts

Create My First Escrow 
Create a git escrow bounty for this repository. Help me gather the missing values before submitting.
Use a Remote Test Suite 
Create a git escrow bounty for a remote test suite. Ask me for the repository URL and commit hash.
Prepare a Sepolia Bounty 
Prepare a Sepolia git escrow bounty. Confirm my reward, token, oracle, and arbiter before running the submit command.
Review and Submit a Complete Bounty 
Review my complete git escrow bounty parameters, identify any missing risk checks, then submit only after I approve.

Best Practices

  • Use a dedicated wallet with only the funds needed for the bounty.
  • Confirm the network, reward, token, oracle, and arbiter before submission.
  • Keep private keys out of chat, logs, shell history, and shared terminals.

Avoid

  • Do not paste a real private key into the conversation.
  • Do not submit before reviewing the exact network and reward amount.
  • Do not use unknown oracle, arbiter, or token contracts without review.

Frequently Asked Questions

What does this skill create?
It creates a git escrow bounty that locks an ERC20 reward for passing a failing test suite.
Does it need a private key?
The underlying CLI needs signing credentials. Use a dedicated wallet and do not paste secrets into chat.
Can it use my current repository?
Yes. It can detect the current git remote and HEAD commit when the workspace is a git repository.
Can it verify contract safety?
No. You must review token, oracle, and arbiter contracts before using them with real funds.
What happens after submission?
It reports the escrow UID, key escrow details, and fulfillment guidance for solvers.
Is this suitable for mainnet funds?
Use caution. Test on a testnet first and confirm every parameter before locking tokens.

Developer Details

License

MIT

Author version

v1.0

Skillstore revision

r1

Version notice

The author-declared version is not valid SemVer.

Repository

https://github.com/internet-court/internet-court-skill/tree/main/vendored/arkhai/make-git-escrow

Ref

3f6e026a3363e0954ede7bef0cfe88d4475de137

Maintenance freshness

7/22/2026

Usage

1 downloads · 0 views

File structure

📄 SKILL.md