Skills near-kit Audit History

📦

Audit History

near-kit - 2 audits

Version comparison

Capability and finding changes across audited versions, newest first.

Version	Date	Result	Review items	Change vs previous
v2 Latest	Jul 21, 2026, 03:48 AM	No confirmed findings	0	No capability change
v1	Jul 9, 2026, 11:43 PM	38 confirmed	4	Baseline

Audit version 2 Latest

Jul 21, 2026, 03:48 AM

All 99 static findings are false positives caused by Markdown fences, TypeScript template literals, placeholders, or legitimate NEAR development documentation. The reviewed materials contain no embedded credentials, prompt-injection text, unauthorized command execution, or evidence of data exfiltration. Key-handling examples should still be used only with protected server-side secrets.

5

Files scanned

1,524

Lines analyzed

3

Review items

0

False positives ignored

Risk Factors

⚙️ External commands (41)

🌐 Network access (4)

references/keys-and-testing.md:323 references/transactions.md:186 references/wallets.md:36 references/wallets.md:37

📁 Filesystem access (6)

references/keys-and-testing.md:269 references/keys-and-testing.md:44 references/keys-and-testing.md:44 references/transactions.md:75 SKILL.md:146 SKILL.md:146

Audited by: claude

Audit version 1

Jul 9, 2026, 11:43 PM

The skill is documentation for near-kit and I found no prompt injection or malware intent. Most static hits are false positives from Markdown fences, TypeScript template strings, placeholder URLs, and local example APIs. Key handling examples and ~/.near-credentials access are real sensitive-use risks that need stronger warnings.

5

Files scanned

1,524

Lines analyzed

45

Review items

0

False positives ignored

Confirmed security concerns (38)

High

references/keys-and-testing.md:75

Crypto seed/private key mention

privateKey: "ed25519:...",

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

references/keys-and-testing.md:109

Crypto seed/private key mention

### Direct Private Key

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

references/keys-and-testing.md:116

Crypto seed/private key mention

privateKey: "ed25519:...",

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

references/keys-and-testing.md:128

Crypto seed/private key mention

generateSeedPhrase,

The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.

High

references/keys-and-testing.md:129

Crypto seed/private key mention

parseSeedPhrase,

The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.

High

references/keys-and-testing.md:131

Crypto seed/private key mention

isPrivateKey,

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

references/keys-and-testing.md:133

Crypto seed/private key mention

validatePrivateKey,

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

references/keys-and-testing.md:145

Crypto seed/private key mention

### generateSeedPhrase()

The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.

High

references/keys-and-testing.md:148

Crypto seed/private key mention

const seedPhrase = generateSeedPhrase();

The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.

High

references/keys-and-testing.md:152

Crypto seed/private key mention

### parseSeedPhrase()

The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.

High

references/keys-and-testing.md:155

Crypto seed/private key mention

const keyPair = parseSeedPhrase(seedPhrase);

The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.

High

references/keys-and-testing.md:164

Crypto seed/private key mention

### Full Seed Phrase Flow

The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.

High

references/keys-and-testing.md:167

Crypto seed/private key mention

import { Near, generateSeedPhrase, parseSeedPhrase } from "near-kit";

The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.

High

references/keys-and-testing.md:171

Crypto seed/private key mention

privateKey: "ed25519:...",

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

references/keys-and-testing.md:175

Crypto seed/private key mention

// Generate seed phrase (returns a string)

The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.

High

references/keys-and-testing.md:176

Crypto seed/private key mention

const seedPhrase = generateSeedPhrase();

The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.

High

references/keys-and-testing.md:179

Crypto seed/private key mention

const keyPair = parseSeedPhrase(seedPhrase);

The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.

High

references/keys-and-testing.md:195

Crypto seed/private key mention

isPrivateKey("ed25519:..."); // true

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

references/keys-and-testing.md:197

Crypto seed/private key mention

validatePrivateKey("ed25519:..."); // throws if invalid

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

references/keys-and-testing.md:308

Crypto seed/private key mention

privateKey: "ed25519:...",

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

references/react.md:41

Crypto seed/private key mention

const near = new Near({ network: "testnet", privateKey: "..." })

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

references/transactions.md:168

Crypto seed/private key mention

privateKey: "ed25519:...",

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

references/transactions.md:200

Crypto seed/private key mention

privateKey: "ed25519:...",

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

references/transactions.md:232

Crypto seed/private key mention

.signWith(privateKey) // specify which key signs

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

references/wallets.md:216

Crypto seed/private key mention

import { Near, fromHotConnect, fromWalletSelector, type WalletConnection, type PrivateKey } from "ne

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

references/wallets.md:219

Crypto seed/private key mention

| { env: "server"; privateKey: PrivateKey; signerId: string }

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

references/wallets.md:226

Crypto seed/private key mention

privateKey: config.privateKey,

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

references/wallets.md:250

Crypto seed/private key mention

privateKey: "ed25519:...",

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

Crypto seed/private key mention

privateKey: "ed25519:...",

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

Crypto seed/private key mention

import { generateKey, parseSeedPhrase, generateSeedPhrase } from "near-kit";

The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.

High

Crypto seed/private key mention

// Direct private key

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

Crypto seed/private key mention

privateKey: "ed25519:...",

The documentation demonstrates private key or key validation patterns for signing. The examples use placeholders, but the guidance still involves sensitive wallet credentials.

High

Crypto seed/private key mention

generateSeedPhrase,

The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.

High

Crypto seed/private key mention

parseSeedPhrase,

The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.

High

Crypto seed/private key mention

// generateSeedPhrase() returns a string (just the phrase)

The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.

High

Crypto seed/private key mention

const seedPhrase = generateSeedPhrase();

The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.

High

Crypto seed/private key mention

// parseSeedPhrase() returns a KeyPair-like object

The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.

High

Crypto seed/private key mention

const keyPair = parseSeedPhrase("word1 word2 ... word12");

The documentation teaches seed phrase generation or parsing, which handles wallet recovery secrets. Even with placeholders, this requires high-care secret handling guidance.

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/keys-and-testing.md:44

Hidden file in home directory

keyStore: new FileKeyStore("~/.near-credentials", "mainnet"),

The documentation uses FileKeyStore with ~/.near-credentials, a hidden home-directory credential store. That path can contain wallet keys, so the access pattern is a real sensitive-filesystem risk.

High

references/keys-and-testing.md:44

Hidden file access

keyStore: new FileKeyStore("~/.near-credentials", "mainnet"),

The documentation uses FileKeyStore with ~/.near-credentials, a hidden home-directory credential store. That path can contain wallet keys, so the access pattern is a real sensitive-filesystem risk.

High

Hidden file in home directory

keyStore: new FileKeyStore("~/.near-credentials", "testnet"),

The documentation uses FileKeyStore with ~/.near-credentials, a hidden home-directory credential store. That path can contain wallet keys, so the access pattern is a real sensitive-filesystem risk.

High

Hidden file access

keyStore: new FileKeyStore("~/.near-credentials", "testnet"),

The documentation uses FileKeyStore with ~/.near-credentials, a hidden home-directory credential store. That path can contain wallet keys, so the access pattern is a real sensitive-filesystem risk.

Risk Factors

⚙️ External commands (41)

🌐 Network access (4)

references/keys-and-testing.md:323 references/transactions.md:186 references/wallets.md:36 references/wallets.md:37

📁 Filesystem access (6)

references/keys-and-testing.md:269 references/keys-and-testing.md:44 references/keys-and-testing.md:44 references/transactions.md:75 SKILL.md:146 SKILL.md:146

Audited by: codex

← Back to Skill