📦
Audit History
make-git-escrow - 2 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 2 Latest
Jul 21, 2026, 03:22 AM
The skill legitimately automates blockchain escrow creation, but it invokes third-party CLI commands and handles a private key. Several static matches are documentation-only false positives; confirmed findings cover secret configuration, command-line private-key exposure, and value-bearing escrow actions. Publication should require safeguards for secrets, package execution, and explicit transaction confirmation.
1
Files scanned
91
Lines analyzed
13
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Crypto seed/private key mention
git-escrows new-client --privateKey "0x..." --network "sepolia"
The new-client example places a private key on a command line. Command-line secrets can leak through shell history, process listings, or logs.
High
Irreversible Token Escrow Submission
The skill directs the user to submit a bounty that locks token rewards in an escrow. It does not require an explicit final confirmation after displaying the transaction network, token, amount, and contract addresses.
The workflow explicitly gathers a reward and then submits the escrow through the CLI. This is a value-bearing blockchain action, and the supplied workflow lacks a final confirmation checkpoint.
Capability review items (8)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
compatibility: Requires git-escrows CLI, a configured .env with PRIVATE_KEY, and network access to a
The skill requires a configured PRIVATE_KEY for blockchain transactions. Private-key access is security-sensitive because it controls funds.
High
Generic API/secret keys
Verify it contains at least `PRIVATE_KEY` and `NETWORK` (or defaults to anvil). For base-sepolia and
The workflow directs verification of PRIVATE_KEY and network configuration. Reading secret-bearing configuration requires strict non-disclosure controls.
Medium
Ruby/shell backtick execution
You are automating the creation of a git escrow bounty via the `git-escrows submit` CLI command. Thi
The workflow directs the agent to automate git-escrows CLI commands that can create a funded blockchain escrow. This is an external, value-bearing action and needs explicit confirmation.
Medium
Ruby/shell backtick execution
Run `git-escrows --help` to verify the CLI is installed. If it fails, try `npx git-escrows --help` o
It executes the git-escrows CLI and may fall back to npx or bunx. Package execution can run third-party code and should be pinned and confirmed.
Medium
Ruby/shell backtick execution · 3 occurrences
```
The documented new-client command can create or configure a blockchain client using a private key. It is an external command with security-sensitive effects.
Medium
Ruby/shell backtick execution
Verify it contains at least `PRIVATE_KEY` and `NETWORK` (or defaults to anvil). For base-sepolia and
The workflow instructs inspection of configuration containing a private key. Secret-bearing environment data requires guarded handling and must never be exposed.
Risk Factors
⚙️ External commands (18)
🌐 Network access (1)
🔑 Env variables (3)
Audited by: claude
Jul 10, 2026, 12:11 AM
The skill has a legitimate purpose, but it handles private-key configuration and runs a CLI that can lock ERC20 tokens. Most Markdown backtick findings are false positives, while the submit command, private-key workflow, and unpinned npx or bunx fallback remain material risks.
1
Files scanned
91
Lines analyzed
17
Review items
0
False positives ignored
Confirmed security concerns (7)
High
Environment file access
compatibility: Requires git-escrows CLI, a configured .env with PRIVATE_KEY, and network access to a
The skill states that a configured .env with PRIVATE_KEY is required. This involves sensitive file-based credential configuration.
High
Environment file access
- .env
The metadata lists .env as required configuration. The same file is later used for private-key and network settings.
High
Environment file access
## Step 2: Check .env configuration
The section heading introduces a workflow step for checking .env configuration. Its risk is confirmed by the following instructions to verify PRIVATE_KEY and NETWORK.
High
Environment file access
Check if a `.env` file exists in the current directory. If not, tell the user they need one and sugg
The skill instructs the agent to check for a .env file in the current directory. It is presence-only at this line, but it targets a file commonly containing secrets.
High
Crypto seed/private key mention
git-escrows new-client --privateKey "0x..." --network "sepolia"
The setup command includes a --privateKey argument. Passing private keys through command-line arguments can expose them in shell history, logs, or process listings.
High
Token Escrow Transaction Requires Explicit Consent
The skill creates a git escrow that locks ERC20 tokens through git-escrows submit. Wrong network, reward, token, oracle, or arbiter values can lock funds or route them to unintended contracts.
The file directly states that the command locks ERC20 tokens and shows the submit command with reward and contract parameters. This is a clear financial transaction risk, not just a command-execution pattern.
Medium
Unpinned Remote CLI Execution Fallback
The skill allows npx or bunx as fallback runners for git-escrows. Without a pinned package version, this can execute the latest registry package in a sensitive signing workflow.
Line 27 explicitly recommends npx and bunx fallback execution. The risk depends on package registry integrity, but the workflow handles private keys and token escrow submission.
Capability review items (7)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
```
The code block instructs the agent to run git-escrows submit with user-provided repository, reward, token, oracle, and arbiter values. This can lock real ERC20 tokens and depends on external contract addresses.
High
Generic API/secret keys
compatibility: Requires git-escrows CLI, a configured .env with PRIVATE_KEY, and network access to a
The compatibility text requires a .env file with PRIVATE_KEY for blockchain signing. That is sensitive credential material even when needed for the workflow.
High
Generic API/secret keys
primaryEnv: PRIVATE_KEY
The metadata declares PRIVATE_KEY as the primary environment value. This confirms the skill depends on access to a private signing key.
High
Generic API/secret keys
Verify it contains at least `PRIVATE_KEY` and `NETWORK` (or defaults to anvil). For base-sepolia and
The skill tells the agent to verify that .env contains PRIVATE_KEY and NETWORK. Reading or validating secret-bearing environment configuration is a real credential-handling risk.
Medium
Ruby/shell backtick execution
You are automating the creation of a git escrow bounty via the `git-escrows submit` CLI command. Thi
The skill explicitly automates the git-escrows submit CLI, so external command execution is part of its behavior. The command is expected, but it can create a token escrow transaction.
Medium
Ruby/shell backtick execution
Run `git-escrows --help` to verify the CLI is installed. If it fails, try `npx git-escrows --help` o
The skill instructs the agent to run git-escrows, npx, or bunx to locate the CLI. The npx and bunx fallback can execute a package from outside the repository.
Medium
Ruby/shell backtick execution
```
The fenced block contains a git-escrows new-client command that can initialize wallet configuration. It is expected setup behavior but still asks the agent to run an external CLI.
Risk Factors
⚙️ External commands (18)
🌐 Network access (1)
🔑 Env variables (3)
Audited by: codex