Versioned security assessment

Report ID: SA-3F6E026A

7/21/2026, 4:24:39 AM

openserv-agent-sdk security assessment v2

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: claude Latest published report
Skill name
openserv-agent-sdk
Version
v2
Maintainer
internet-court
Source
github.com/internet-court/internet-court-skill/tree/main/vendored/openserv/openserv-agent-sdk
Coverage
12 Files scanned · 1,559 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

6 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

This is a documentation-only skill teaching how to build agents with the OpenServ TypeScript SDK (@openserv-labs/sdk); it ships Markdown reference docs and .ts example files, not an executable installer. Of 248 static hits, 237 are false positives: the "shell backtick execution" flags are JavaScript template literals and Markdown code fences, and the "API/secret key" and ".env" flags are placeholder names in an env.example and configuration prose with no real secrets embedded. 11 findings are kept at low severity for visibility because the documented provision() flow persists a crypto WALLET_PRIVATE_KEY to .env for on-chain (ERC-8004 / x402 / USDC) payments — a transparent, documented behavior a reviewer should be aware of, not exfiltration.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Attestation unavailable

No public attestation is available for this report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

12 Files scanned · 1,559 Lines analyzed

12 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 4 evidence locations

Network access

May connect to external services.

Observed in 8 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Observed in 42 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 50 evidence locations

Capability review items (6)
High
examples/env.example:10
Generic API/secret keys
WALLET_PRIVATE_KEY=
Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.
High
reference.md:276
Generic API/secret keys
// Top up credits with USDC (uses WALLET_PRIVATE_KEY env var)
Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.
High
reference.md:289
Generic API/secret keys
**Important:** `provision()` writes `WALLET_PRIVATE_KEY` to `.env` at runtime. If you use `import 'd
Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.
High
reference.md:340
Generic API/secret keys
WALLET_PRIVATE_KEY=auto-populated (also used for x402 payments, USDC top-up, and ERC-8004 registrati
Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.
High
SKILL.md:406
Generic API/secret keys
// Reload .env to pick up WALLET_PRIVATE_KEY written by provision()
Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.
High
troubleshooting.md:143
Generic API/secret keys
**Tip:** After `provision()` runs, the `WALLET_PRIVATE_KEY` is stored in `.env`. Use `dotenv.config(
Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (6)

RISK-001 High
reference.md:289
Environment file access
**Important:** `provision()` writes `WALLET_PRIVATE_KEY` to `.env` at runtime. If you use `import 'd
Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.
RISK-002 High
reference.md:306
Crypto seed/private key mention
privateKey: process.env.WALLET_PRIVATE_KEY!,
Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.
RISK-003 High
SKILL.md:406
Environment file access
// Reload .env to pick up WALLET_PRIVATE_KEY written by provision()
Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.
RISK-004 High
SKILL.md:416
Crypto seed/private key mention
privateKey: process.env.WALLET_PRIVATE_KEY!,
Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.
RISK-005 High
troubleshooting.md:143
Environment file access
**Tip:** After `provision()` runs, the `WALLET_PRIVATE_KEY` is stored in `.env`. Use `dotenv.config(
Documents that provision() persists a crypto WALLET_PRIVATE_KEY to the .env file at runtime for on-chain (ERC-8004 / x402 / USDC) payments. This is a transparent, documented capability, not exfiltration, but persisting a wallet private key to disk is genuinely sensitive, so it is kept at low severity for reviewer visibility.
RISK-006 Low
reference.md:289reference.md:306SKILL.md:406-416
Documented runtime persistence of a crypto wallet private key to .env
The reference and SKILL docs describe provision() writing WALLET_PRIVATE_KEY into the local .env file at runtime, then reloading it via dotenv.config({ override: true }), so the agent can sign on-chain ERC-8004 registration and x402/USDC payment transactions. This is transparent, intended SDK behavior documented for the developer — not covert exfiltration — but reviewers and users should understand that a spendable private key is stored in plaintext on disk and used to move funds on Base mainnet.
The behavior is explicitly documented as an intended SDK feature for payments, so it is not malicious; the low-but-nonzero confidence reflects the genuine sensitivity of persisting a spendable private key to a plaintext .env rather than any sign of hidden intent.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Low
    The provision() workflow persists a wallet private key (WALLET_PRIVATE_KEY) to the .env file at runtime for on-chain payments.
    Document that WALLET_PRIVATE_KEY should be a low-value, dedicated payment wallet, that .env must be gitignored, and consider recommending a secrets manager or KMS over a plaintext .env file for production deployments.
  2. FIX-002
    Low
    env.example lists commented placeholders for third-party keys (OPENAI_API_KEY, ANTHROPIC_API_KEY).
    Keep these as clearly commented, empty placeholders (as they already are) and add a one-line note that most agents need no LLM key when using runless capabilities or generate().

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
3f6e026a3363e0954ede7bef0cfe88d4475de137
Content hash
11889e6dcecacff187f6490c6638695bb546e2a3254df44bb11e0a05e29c36e1
Tree hash
71898b48419b93968d81623ce81e91d4e208bb14bb6e32645f8efab5e16615ae
Skill path
skills/internet-court/openserv-agent-sdk
Audit payload hash
fef700dd94c3d7b53d018fba71477423

Analysis metadata

Audit model: claude

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: unavailable