📦

Privy

Name: Privy
Author: internet-court

v1.0 Content revision r1 Critical ⚙️ External commands🌐 Network access

Build Privy Wallet and Auth Integrations

Wallet and authentication integrations are difficult to design safely across clients, servers, and chains. This skill gives Claude, Codex, and Claude Code concise Privy guidance for setup, wallet creation, policies, transactions, and webhooks.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "Privy" from https://skillstore.io/skills/internet-court-privy.md and its manifest at https://skillstore.io/api/skills/internet-court-privy/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/internet-court-privy.md Signed manifest GET /api/skills/internet-court-privy/manifest Signed lockfile GET /api/skills/internet-court-privy/lockfile

Test it

Using "Privy". Plan Privy setup for a React app with email login and embedded wallets.

Expected outcome:

Use the Privy provider component at the application root.
Enable email login and embedded wallet creation in the dashboard.
Wait for the ready state before reading user or wallet data.

Using "Privy". Review a server-side wallet transaction flow.

Expected outcome:

Confirm wallet ownership and signer permissions before submitting transactions.
Test policy decisions with expected recipients, amounts, and chain identifiers.
Use idempotency keys and monitor webhook events after submission.

Using "Privy". Prepare a launch checklist for Privy webhooks.

Expected outcome:

Register the webhook endpoint in the dashboard.
Verify every webhook signature before trusting payload data.
Add retries, logging controls, and incident alerts for failed processing.

Security Audit

Critical

v2 • 7/19/2026 Open versioned report

Thirty-one external-command alerts are Markdown fences or inline code references, not shell backtick execution. Official Privy URLs do not indicate exfiltration. Transaction submission remains critical because it can move cryptocurrency irreversibly without an explicit approval gate.

Files scanned

208

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

Critical

SKILL.md:157

Cryptocurrency wallet

- **Server-side:** Call `privy.wallets().ethereum().sendTransaction()` or equivalent

Line 157 instructs use of a server-side method that can submit cryptocurrency transactions. Incorrect use can cause immediate and irreversible financial loss.

High

SKILL.md:155-159

Missing Explicit Transaction Approval Gate

The transaction workflow proceeds from method selection to payload handling without requiring final user confirmation, simulation, or recipient verification before submission.

The listed execution steps omit an approval gate despite describing methods that can transfer blockchain assets.

Medium

SKILL.md:59-62

Credential Exposure in Shell Command

The REST example places an encoded application secret in a command argument. Real substitutions may remain in shell history or process listings.

The Basic authorization argument explicitly combines appId and appSecret, although the published value is only a placeholder.

Detected Patterns

Cryptocurrency wallet

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/internet-court-privy/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/internet-court-privy/security.svg)](https://skillstore.io/skills/internet-court-privy?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/internet-court-privy?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-privy/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/internet-court-privy.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

internet-court. (2026). Privy security audit report (audit version 2) [Author version 1.0]. Skillstore. https://skillstore.io/skills/internet-court-privy/audits/2

BibTeX citation

@techreport{internet-court-internet-court-privy-2026,
  author = {internet-court},
  title = {Privy security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/internet-court-privy/audits/2},
  note = {Author version 1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "Privy security audit report (audit version 2)"
version: "1.0"
type: report
authors:
  - name: "internet-court"
date-released: "2026-07-19"
url: "https://skillstore.io/skills/internet-court-privy/audits/2"
identifiers:
  - type: other
    value: "skillstore:internet-court-privy:audit:2"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Design user onboarding

Choose login methods, embedded wallet behavior, and client setup for a new application using Privy.

Plan server wallet operations

Map wallet creation, signer permissions, transaction submission, policy checks, and webhook processing before backend implementation.

Review launch readiness

Check secrets, policies, chain identifiers, numeric units, webhook verification, idempotency, and rate-limit handling before release.

Try These Prompts

Choose a wallet model

Explain which Privy wallet model fits my consumer app. Compare embedded wallets and external wallets for users who sign their own transactions.

Create an auth checklist

Draft an implementation checklist for adding Privy Auth to a React app. Include readiness checks, login methods, and secure credential handling.

Review transaction flow

Review my planned server-side wallet flow for Privy. Identify policy, approval, idempotency, webhook, and unit-conversion risks before implementation.

Design treasury controls

Design a Privy integration plan for a multi-chain treasury app. Cover ownership, signer roles, policy constraints, event monitoring, and rollback planning.

Best Practices

Store App Secret and webhook secrets outside source code and client bundles.
Use policies, approvals, and idempotency keys for transaction paths that move assets.
Verify webhook signatures and test chain IDs, units, and rate-limit handling before launch.

Avoid

Hardcoding secrets in examples, commits, or browser-executed code.
Sending transactions before testing policy decisions, units, and approval requirements.
Trusting webhook payloads without signature verification.

Frequently Asked Questions

Can this skill create wallets for me?

No. It explains Privy concepts and integration steps. You must implement and authorize wallet creation in your application.

Does it support Ethereum and Solana?

Yes. The source covers Ethereum and Solana examples, and mentions several other supported chains.

Can it replace Privy documentation?

No. Use it for quick guidance, then verify current API details in official Privy documentation.

Is it safe for production wallet custody decisions?

Use it as planning help only. Review custody, compliance, approvals, and incident response with qualified teams.

Does it expose secrets?

The skill contains placeholder credentials and advises secure storage. Do not paste real secrets into prompts or client code.

Which tools can use it?

The report marks it compatible with Claude, Codex, and Claude Code.

Developer Details

Author

internet-court

License

MIT

Author version

v1.0

Skillstore revision

Version notice

The author-declared version is not valid SemVer.

Repository

https://github.com/internet-court/internet-court-skill/tree/main/vendored/privy/privy

Ref

3f6e026a3363e0954ede7bef0cfe88d4475de137

Maintenance freshness

7/18/2026

Usage

1 downloads · 0 views

File structure

📄 SKILL.md

Privy

Install with my Agent

Agent-readable resources

Test it

Security Audit

Confirmed security concerns (3)

Risk Factors

Detected Patterns

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Skillstore Score

What You Can Build

Design user onboarding

Plan server wallet operations

Review launch readiness

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details