Skills near-smart-contracts
๐Ÿ“ฆ

near-smart-contracts

v1.0.0 Content revision r1 Critical ๐ŸŒ Network accessโš™๏ธ External commands๐Ÿ”‘ Env variables

Build NEAR Smart Contracts Safely

NEAR contract development requires precise Rust patterns for storage, calls, migrations, testing, and security. This skill gives Codex, Claude, and Claude Code practical NEAR SDK guidance for building and reviewing contracts.

Supports: Claude Codex Code(CC)
โš ๏ธ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "near-smart-contracts" from https://skillstore.io/skills/internet-court-near-smart-contracts.md and its manifest at https://skillstore.io/api/skills/internet-court-near-smart-contracts/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Test it

Using "near-smart-contracts". Review a payable method that writes user data.

Expected outcome:

  • Requires predecessor validation before writes.
  • Compute storage usage before and after the write.
  • Require enough attached deposit and refund extra NEAR.
  • Test low-deposit and unauthorized caller cases.

Using "near-smart-contracts". Plan a contract upgrade with a new state field.

Expected outcome:

  • Define the old state shape before deployment.
  • Add a private migration entry point for the new state.
  • Deploy code and call migration in one controlled flow.
  • Use governance or multisig approval for production updates.

Using "near-smart-contracts". Design an MPC signing flow for Ethereum.

Expected outcome:

  • Derive the foreign address before funding it.
  • Build the unsigned transaction off-chain or in contract logic.
  • Request the MPC signature with enough gas and a callback.
  • Finalize and broadcast the signed transaction off-chain.

Security Audit

Critical
v2 โ€ข 7/21/2026 Open versioned report

Most static findings are false positives caused by Markdown formatting, educational code examples, and NEAR-specific terminology. Three installation commands download and execute unpinned remote scripts or installers, which presents a critical supply-chain execution risk. The skill contains no evidence of prompt injection or credential exfiltration.

10
Files scanned
2,297
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (3)

Critical
Pipe to shell pattern
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
This command downloads a remote installer or script and immediately executes it with sh. The URLs use moving latest-release content and no checksum or signature verification is shown, creating a supply-chain execution risk.
Critical
Pipe to shell pattern
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/cargo-near/releases/latest/download/ca
This command downloads a remote installer or script and immediately executes it with sh. The URLs use moving latest-release content and no checksum or signature verification is shown, creating a supply-chain execution risk.
Critical
Pipe to shell pattern
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/near-cli-rs/releases/latest/download/n
This command downloads a remote installer or script and immediately executes it with sh. The URLs use moving latest-release content and no checksum or signature verification is shown, creating a supply-chain execution risk.

Risk Factors

๐ŸŒ Network access (32)
โš™๏ธ External commands (50)
๐Ÿ”‘ Env variables (9)

Detected Patterns

Pipe to shell patternร—3
Audited by: claude View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/internet-court-near-smart-contracts/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/internet-court-near-smart-contracts/security.svg)](https://skillstore.io/skills/internet-court-near-smart-contracts?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/internet-court-near-smart-contracts?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-near-smart-contracts/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/internet-court-near-smart-contracts.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

internet-court. (2026). near-smart-contracts security audit report (audit version 2) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/internet-court-near-smart-contracts/audits/2

BibTeX citation

@techreport{internet-court-internet-court-near-smart-contracts-2026, author = {internet-court}, title = {near-smart-contracts security audit report (audit version 2)}, institution = {Skillstore}, year = {2026}, number = {2}, url = {https://skillstore.io/skills/internet-court-near-smart-contracts/audits/2}, note = {Author version 1.0.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "near-smart-contracts security audit report (audit version 2)" version: "1.0.0" type: report authors: - name: "internet-court" date-released: "2026-07-21" url: "https://skillstore.io/skills/internet-court-near-smart-contracts/audits/2" identifiers: - type: other value: "skillstore:internet-court-near-smart-contracts:audit:2" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
100
Maintainability
87
Content
65
Community
83
Spec Compliance

What You Can Build

Create a NEAR contract

A developer uses the skill to structure contracts, choose SDK macros, and add storage checks before implementation.

Review cross-contract behavior

An engineer checks promise chaining, callbacks, gas allocation, and migration plans before deploying an update.

Plan integration tests

A tester designs near-sandbox scenarios for deployment, calls, balances, callbacks, failures, and time-sensitive behavior.

Try These Prompts

Create a contract outline
Use the near-smart-contracts skill to outline a Rust NEAR contract for [purpose]. Include state, initialization, storage checks, and tests.
Review storage safety
Use the near-smart-contracts skill to review this storage update flow: [describe flow]. Identify missing deposits, refunds, and access checks.
Design cross-contract calls
Use the near-smart-contracts skill to design a promise chain between [contract A] and [contract B]. Include gas, callbacks, and failure handling.
Plan migration and signing
Use the near-smart-contracts skill to plan a migration from [old state] to [new state], then add MPC signing for [target chain].

Best Practices

  • Use cargo-near templates, then verify generated settings before adding business logic.
  • Update state only after promise results are checked in private callbacks.
  • Treat private keys and signer credentials as off-chain secrets with explicit handling rules.

Avoid

  • Piping remote installers directly into a shell without verification.
  • Deploying changed state layouts without a migration method and rollback plan.
  • Using unprotected resume or callback methods for external data.

Frequently Asked Questions

Does this skill write code automatically?
It provides guidance and examples. The user or agent still chooses edits and runs checks.
Which NEAR SDK version does it target?
It targets near-sdk-rs v5.x patterns, including the newer near macro syntax.
Can it help with security review?
Yes. It highlights common NEAR risks, but it does not replace independent security review.
Does it support chain signatures?
Yes. It explains MPC signing flows, payload construction, callbacks, and off-chain transaction finalization.
Can it deploy to mainnet?
No. It documents deployment commands, but account choice, signing, and network actions require user control.
Why is installation guidance flagged?
The skill includes pipe-to-shell installer examples. Marketplace users should verify installers before running them.

Developer Details

License

MIT

Author version

v1.0.0

Skillstore revision

r1

Ref

3f6e026a3363e0954ede7bef0cfe88d4475de137

Maintenance freshness

7/20/2026

Usage

1 downloads ยท 0 views

More from internet-court

View all
View all