Audit History

The 400 static matches are predominantly documentation noise for template literals, diagrams, documented endpoints, and conventional environment-variable configuration. Two direct wallet-private-key references are confirmed security-sensitive, and the workflow examples also lack verification before assigning work to marketplace agents. Static review was capped at 400/444 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Adjudicated 400 static findings across 14 documentation and example markdown files; all resolved as false positives. The skill is educational documentation for building multi-agent workflows on the OpenServ platform: env-var reads of WALLET_PRIVATE_KEY are the documented, secure way to supply credentials (secrets live in .env, never hardcoded); flagged 'backtick execution' and 'system reconnaissance' matches are JavaScript template literals in console.log calls and mermaid diagram fences, respectively; and hardcoded URLs point only to the platform's own api.openserv.ai endpoint. No executable scripts, no data exfiltration, no command execution, and no real secrets were found. Static review was capped at 400/444 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

The high-impact confirmed findings are credential-handling patterns in runnable examples, especially WALLET_PRIVATE_KEY and OPENAI_API_KEY usage. Most external command, system reconnaissance, and hardcoded URL findings are false positives caused by Markdown, TypeScript template literals, and documented OpenServ endpoints. Additional context concerns involve paid x402/on-chain wallet workflows and local tunnel exposure. Static review was capped at 400/444 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.