Skills near-api-js
📦
near-api-js
Content revision r1 Medium Risk ⚙️ External commands🌐 Network access
Build NEAR Apps with near-api-js
NEAR developers need reliable examples for accounts, contracts, tokens, and signing. This skill provides focused near-api-js v7 patterns for Claude, Codex, and Claude Code.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "near-api-js" from https://skillstore.io/skills/internet-court-near-api-js.md and its manifest at https://skillstore.io/api/skills/internet-court-near-api-js/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "near-api-js". I need to call a payable contract method from a NEAR web app.
Expected outcome:
- Provider and account setup plan for the selected network.
- Contract call steps with required gas, deposit, and signer notes.
- Error handling checks for failed transactions and missing accounts.
Using "near-api-js". I need a gasless minting flow for users without NEAR.
Expected outcome:
- User-side signed delegate action flow.
- Relayer-side submission plan with expiration handling.
- Security notes for relayer trust, nonce lifetime, and action scope.
Using "near-api-js". I need wallet login with NEP-413.
Expected outcome:
- Nonce generation and message-signing sequence.
- Server verification checklist using account ID, public key, signature, and payload.
- Replay protection notes for nonce storage and expiration.
Security Audit
Medium Riskv2 • 7/21/2026 Open versioned report
All 105 static detections are false positives caused by Markdown fences, JavaScript template literals, documentation endpoints, cryptographic API examples, or validation examples. No prompt injection, hidden command execution, embedded live secret, or covert exfiltration behavior was found. The skill documents consequential blockchain actions and should add explicit confirmation and testnet-first guidance.
7
Files scanned
2,119
Lines analyzed
0
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
Irreversible blockchain actions lack safety guidance
The documentation demonstrates transfers, full-access key changes, and account deletion without requiring transaction simulation or explicit user confirmation. An agent following these examples could initiate consequential on-chain actions if a user supplies signing access.
The cited sections directly demonstrate value transfer, access-key changes, and account deletion. The omission of confirmation and testnet-first controls is clear, though actual execution depends on the consuming agent and user approval.
Risk Factors
⚙️ External commands (48)
references/api_patterns.md:186-187 references/api_patterns.md:381-385 references/key_management.md:155-161 references/key_management.md:229-232 references/key_management.md:280-281 references/nep413.md:85-114 references/tokens_guide.md:83-87 SKILL.md:19-48 SKILL.md:48-52 SKILL.md:52-91 SKILL.md:91-99 SKILL.md:99-153 SKILL.md:153-157 SKILL.md:157-176 SKILL.md:176-182 SKILL.md:182-207 SKILL.md:207-211 SKILL.md:211-218 SKILL.md:218-222 SKILL.md:222-277 SKILL.md:277-281 SKILL.md:281-296 SKILL.md:296-300 SKILL.md:300-309 SKILL.md:309-313 SKILL.md:313-352 SKILL.md:352-358 SKILL.md:358-371 SKILL.md:371-377 SKILL.md:377-378 SKILL.md:378-379 SKILL.md:379-380 SKILL.md:380-386 SKILL.md:386-394 SKILL.md:394-398 SKILL.md:398-409 SKILL.md:409-413 SKILL.md:413-420 SKILL.md:420-424 SKILL.md:424-450 SKILL.md:450-454 SKILL.md:454-467 SKILL.md:467-471 SKILL.md:471-487 SKILL.md:487-491 SKILL.md:491-509 SKILL.md:509-537 SKILL.md:537-566
🌐 Network access (18)
references/api_patterns.md:241 references/api_patterns.md:276 references/api_patterns.md:321 references/contracts.md:25 references/meta_transactions.md:134 references/meta_transactions.md:134 references/nep413.md:92 references/nep413.md:21 references/nep413.md:26 SKILL.md:24 SKILL.md:183 SKILL.md:187 SKILL.md:188 SKILL.md:189 SKILL.md:377 SKILL.md:378 SKILL.md:379 SKILL.md:380
Audited by: claude View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/internet-court-near-api-js/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/internet-court-near-api-js?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/internet-court-near-api-js?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-near-api-js/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/internet-court-near-api-js.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
internet-court. (2026). near-api-js security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/internet-court-near-api-js/audits/2BibTeX citation
@techreport{internet-court-internet-court-near-api-js-2026,
author = {internet-court},
title = {near-api-js security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/internet-court-near-api-js/audits/2},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "near-api-js security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
- name: "internet-court"
date-released: "2026-07-21"
url: "https://skillstore.io/skills/internet-court-near-api-js/audits/2"
identifiers:
- type: other
value: "skillstore:internet-court-near-api-js:audit:2"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 45
Architecture
85
Maintainability
87
Content
65
Community
78
Spec Compliance
What You Can Build
Create a dApp integration
Build account, provider, and contract calls for a NEAR web application.
Add token operations
Implement NEAR, fungible token, NFT, and storage registration flows.
Design signing flows
Plan key management, NEP-413 authentication, and relayer-sponsored transactions.
Try These Prompts
Start a NEAR connection
Show me how to connect a TypeScript app to NEAR testnet with near-api-js v7. Include provider and account setup.
Call a contract method
Help me call a NEAR smart contract with near-api-js. Compare a read-only view call with a signed change call.
Implement token transfers
Design a near-api-js flow for transferring a fungible token and registering the receiver for storage when needed.
Review advanced signing
Review my near-api-js plan for meta transactions, NEP-413 authentication, and key rotation. Identify security and reliability concerns.
Best Practices
- Use testnet examples first, then switch endpoints and account names deliberately.
- Keep private keys, seed phrases, and signer material out of logs and source control.
- Set clear gas, deposit, allowance, and transaction finality requirements for each call.
Avoid
- Do not paste real private keys or seed phrases into prompts or examples.
- Do not use unlimited access key allowances without a documented security reason.
- Do not relay signed delegate actions without validating receiver, method, amount, and expiration.
Frequently Asked Questions
What is near-api-js?
near-api-js is a JavaScript and TypeScript library for interacting with NEAR accounts, contracts, transactions, and RPC APIs.
Does this skill support Claude, Codex, and Claude Code?
Yes. The report lists support for Claude, Codex, and Claude Code.
Can this skill send real transactions?
No. It provides guidance and examples. The user or application controls any actual transaction submission.
Does it cover token storage deposits?
Yes. The token guide includes registration and storage deposit patterns for NEP-141 token workflows.
Does it explain NEP-413 authentication?
Yes. It covers signing messages, verifying signatures, nonce use, and server-side verification flow.
How should users handle private keys?
Users should keep keys out of prompts, logs, source control, and browser code unless a secure wallet flow is used.
Developer Details
Author
internet-courtLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/internet-court/internet-court-skill/tree/main/vendored/near/near-api-jsRef
3f6e026a3363e0954ede7bef0cfe88d4475de137
Maintenance freshness
7/21/2026
Usage
1 downloads · 0 views
File structure