Skills nla-fulfill
📦

nla-fulfill

v1.0 Content revision r1 High Risk ⚙️ External commands🔑 Env variables

Fulfill NLA Escrows and Collect Tokens

NLA escrow fulfillment requires careful command order, arbitration tracking, and wallet readiness. This skill guides users through status checks, fulfillment submission, approval monitoring, and collection.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "nla-fulfill" from https://skillstore.io/skills/internet-court-nla-fulfill.md and its manifest at https://skillstore.io/api/skills/internet-court-nla-fulfill/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/internet-court-nla-fulfill.md Signed manifest GET /api/skills/internet-court-nla-fulfill/manifest Signed lockfile GET /api/skills/internet-court-nla-fulfill/lockfile

Test it

Using "nla-fulfill". Inspect escrow 0xabc and explain what I must provide.

Expected outcome:

The response summarizes the demand, oracle address, current arbitration state, and any existing fulfillments in plain language.

Using "nla-fulfill". Help me prepare a fulfillment for this demand.

Expected outcome:

The response proposes direct fulfillment text, explains why it addresses the demand, and asks for confirmation before submission.

Using "nla-fulfill". The oracle approved my fulfillment. What should happen next?

Expected outcome:

The response identifies the fulfillment UID, explains the collection step, and confirms wallet and gas details before continuing.

Security Audit

High Risk
v2 • 7/21/2026 Open versioned report

Most static findings are false positives caused by Markdown code fences and escrow identifiers. The skill genuinely handles wallet private keys and directs irreversible on-chain transactions without confirmation safeguards. It should protect secrets and require explicit approval before each transaction.

1
Files scanned
114
Lines analyzed
1
Review items
0
False positives ignored

Confirmed security concerns (2)

High
SKILL.md:90
Crypto seed/private key mention
- Private key set via `nla wallet:set`, `--private-key` flag, or `PRIVATE_KEY` env var
The skill instructs users to provide a wallet private key through an environment variable or CLI flag. This can expose credentials through logs, shell history, or agent context.
High
SKILL.md:39-55SKILL.md:67-77
Irreversible On-Chain Actions Lack Confirmation
The workflow directs submission, bonding, and token collection without requiring explicit user confirmation immediately before transactions. These actions can spend gas, create permanent on-chain records, and transfer tokens.
The documented commands submit a bonded fulfillment and transfer escrowed tokens, yet no confirmation checkpoint appears before either external action.
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
SKILL.md:90
Generic API/secret keys
- Private key set via `nla wallet:set`, `--private-key` flag, or `PRIVATE_KEY` env var
The skill recommends using a PRIVATE_KEY environment variable. A wallet private key is highly sensitive and the guidance does not address secure handling.

Risk Factors

⚙️ External commands (11)
SKILL.md:21-23 SKILL.md:23-41 SKILL.md:41-46 SKILL.md:46-61 SKILL.md:61-63 SKILL.md:63-71 SKILL.md:71-75 SKILL.md:75-89 SKILL.md:89-90 SKILL.md:90 SKILL.md:96-113
🔑 Env variables (1)
SKILL.md:90
Audited by: claude View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/internet-court-nla-fulfill/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/internet-court-nla-fulfill/security.svg)](https://skillstore.io/skills/internet-court-nla-fulfill?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/internet-court-nla-fulfill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-nla-fulfill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/internet-court-nla-fulfill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

internet-court. (2026). nla-fulfill security audit report (audit version 2) [Author version 1.0]. Skillstore. https://skillstore.io/skills/internet-court-nla-fulfill/audits/2

BibTeX citation

@techreport{internet-court-internet-court-nla-fulfill-2026, author = {internet-court}, title = {nla-fulfill security audit report (audit version 2)}, institution = {Skillstore}, year = {2026}, number = {2}, url = {https://skillstore.io/skills/internet-court-nla-fulfill/audits/2}, note = {Author version 1.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "nla-fulfill security audit report (audit version 2)" version: "1.0" type: report authors: - name: "internet-court" date-released: "2026-07-21" url: "https://skillstore.io/skills/internet-court-nla-fulfill/audits/2" identifiers: - type: other value: "skillstore:internet-court-nla-fulfill:audit:2" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
65
Community
83
Spec Compliance

What You Can Build

Complete a User-Owned Escrow

Submit a fulfillment, track arbitration, and collect tokens after approval.

Support Escrow Operations

Check demand details, oracle addresses, and fulfillment status before advising a user.

Test Arbitration Workflows

Run a full status, fulfill, arbitrate, and collect cycle on a test network.

Try These Prompts

Check an Escrow 
Use nla-fulfill to inspect escrow UID <uid>. Summarize the demand, oracle address, existing fulfillments, and arbitration state.
Draft Fulfillment Text 
Review escrow UID <uid> and help me draft concise fulfillment text that directly satisfies the demand.
Submit and Monitor 
For escrow UID <uid>, prepare the fulfillment command, ask for confirmation, submit it, and monitor arbitration until a decision appears.
Complete the Full Lifecycle 
Guide the full fulfill, arbitration check, and collect workflow for escrow UID <uid>. Confirm wallet, chain, oracle, gas, and token movement before writes.

Best Practices

  • Confirm the chain, wallet address, oracle address, escrow UID, and gas cost before any write command.
  • Keep private keys out of prompts, command flags, logs, and shared terminal history.
  • Treat fulfillment text as public and permanent before submitting it on-chain.

Avoid

  • Do not paste private keys or seed phrases into the chat or terminal prompt.
  • Do not submit fulfillment text that has not been reviewed against the escrow demand.
  • Do not collect tokens until the oracle has recorded an approved arbitration result.

Frequently Asked Questions

What does this skill help me do?
It helps inspect an NLA escrow, draft fulfillment text, submit fulfillment, monitor arbitration, and collect approved tokens.
Does it create new escrows?
No. It only supports fulfilling and collecting from an existing escrow UID.
What tools are required?
You need the nla CLI, a configured wallet, gas funds, and access to the target EVM chain.
Can it guarantee approval?
No. The oracle decides whether the fulfillment satisfies the demand.
Will fulfillment text be private?
No. The skill states that fulfillment text is permanently recorded on-chain.
Can I use it with Claude, Codex, and Claude Code?
Yes. The report lists Claude, Codex, and Claude Code as supported tools.

Developer Details

License

MIT

Author version

v1.0

Skillstore revision

r1

Version notice

The author-declared version is not valid SemVer.

Repository

https://github.com/internet-court/internet-court-skill/tree/main/vendored/arkhai/nla-fulfill

Ref

3f6e026a3363e0954ede7bef0cfe88d4475de137

Maintenance freshness

7/22/2026

Usage

1 downloads · 0 views

File structure

📄 SKILL.md