Skills starknet-defi

📦

starknet-defi

Name: starknet-defi
Author: internet-court

v1.0.0 Content revision r2 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Execute Starknet DeFi Transactions

Starknet DeFi workflows often require separate knowledge of quotes, protocols, recurring orders, and account configuration. This skill provides practical AVNU-based examples for swaps, DCA, staking, lending, and market data.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "starknet-defi" from https://skillstore.io/skills/internet-court-starknet-defi.md and its manifest at https://skillstore.io/api/skills/internet-court-starknet-defi/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/internet-court-starknet-defi.md Signed manifest GET /api/skills/internet-court-starknet-defi/manifest Signed lockfile GET /api/skills/internet-court-starknet-defi/lockfile

Test it

Using "starknet-defi". What should I review before swapping 0.1 ETH to STRK through AVNU?

Expected outcome:

Verify the ETH and STRK contract addresses.
Review the quote, route, expected output, fees, price impact, and one percent slippage setting.
Confirm the approval and swap transaction separately before signing.
Use a protected signer and verify the RPC and paymaster endpoints.

Using "starknet-defi". How does the documented STRK unstaking flow work?

Expected outcome:

Initiate the unstake first, wait through the documented 21-day cooldown, then complete the unstake transaction.

Using "starknet-defi". What information should a DCA review include?

Expected outcome:

Sell and buy token addresses
Total amount and number of orders
Frequency and start time
Account address, fees, allowances, and cancellation conditions

Security Audit

High Risk

v3 • 8/7/2026 Open versioned report

The static catalog is mostly false positive noise from Markdown fences, documentation URLs, configuration examples, and a relative documentation link. The required signing key is a genuine high-risk credential, and the transaction examples lack an explicit confirmation and safety-control layer.

Files scanned

370

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:50

Crypto seed/private key mention

signer: privateKey,

The account example passes privateKey as the signer, which gives the executing process authority to sign DeFi transactions and requires strict key isolation.

High

SKILL.md:72-77 SKILL.md:170-173 SKILL.md:204-208

Unconfirmed Financial Transaction Execution

Examples directly execute swaps with approvals, create recurring DCA orders, and stake funds without showing a mandatory confirmation, simulation, or transaction limit.

The cited examples call state-changing AVNU operations directly, set executeApprove to true, and provide no visible confirmation or bounded execution policy.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:287

Generic API/secret keys

| `STARKNET_PRIVATE_KEY` | Agent's signing key | Required |

A Starknet private key is signing authority for the funded account. If exposed, an attacker can authorize irreversible asset transfers.

Risk Factors

⚙️ External commands (34)

🌐 Network access (12)

SKILL.md:129 SKILL.md:130 SKILL.md:132 SKILL.md:288 SKILL.md:289 SKILL.md:296 SKILL.md:297 SKILL.md:336 SKILL.md:337 SKILL.md:338 SKILL.md:339 SKILL.md:340

📁 Filesystem access (1)

SKILL.md:28

🔑 Env variables (6)

SKILL.md:44 SKILL.md:132 SKILL.md:44 SKILL.md:132 SKILL.md:287 SKILL.md:290

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/internet-court-starknet-defi/audits/3?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/internet-court-starknet-defi/security.svg)](https://skillstore.io/skills/internet-court-starknet-defi?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/internet-court-starknet-defi?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-starknet-defi/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/internet-court-starknet-defi.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

internet-court. (2026). starknet-defi security audit report (audit version 3) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/internet-court-starknet-defi/audits/3

BibTeX citation

@techreport{internet-court-internet-court-starknet-defi-2026,
  author = {internet-court},
  title = {starknet-defi security audit report (audit version 3)},
  institution = {Skillstore},
  year = {2026},
  number = {3},
  url = {https://skillstore.io/skills/internet-court-starknet-defi/audits/3},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "starknet-defi security audit report (audit version 3)"
version: "1.0.0"
type: report
authors:
  - name: "internet-court"
date-released: "2026-08-07"
url: "https://skillstore.io/skills/internet-court-starknet-defi/audits/3"
identifiers:
  - type: other
    value: "skillstore:internet-court-starknet-defi:audit:3"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Swap Tokens on Starknet

Get a verified token quote, compare route and fee data, then prepare an AVNU swap with a stated slippage limit.

Set Up Recurring Buys

Define token amounts, order count, frequency, and start time for an AVNU DCA order, then review cancellation steps.

Manage Staking Positions

Review staking pool information, stake STRK, inspect rewards, claim or compound them, and follow the unstaking cooldown.

Try These Prompts

Explain a Starknet Swap

Explain how to request an AVNU quote for swapping ETH to STRK. List the inputs, checks, fees, and user confirmations required before signing.

Plan a DCA Order

Create a review checklist for a 100 USDC to STRK DCA order split across ten daily purchases. Include amount, frequency, start time, and cancellation checks.

Review Staking Actions

Compare the documented STRK staking, reward claiming, compounding, and unstaking steps. Identify every state-changing action and the confirmation needed before it.

Design a Controlled Execution Flow

Design a Starknet DeFi execution workflow using AVNU quotes and paymaster support. Add token verification, quote expiry, slippage limits, simulation, private-key isolation, and explicit approval before signing.

Best Practices

Verify token addresses, protocol endpoints, quote freshness, fees, price impact, and slippage before signing.
Use a hardware wallet or external signer, and keep private keys outside agent-readable files and logs.
Test on Sepolia first, set strict amount limits, and require explicit confirmation for every state-changing action.

Avoid

Never paste a Starknet private key into chat, source code, logs, or an unprotected environment.
Do not approve or execute a swap without checking the token addresses, recipient, route, amount, and slippage.
Do not create recurring orders or compound rewards without reviewing duration, total exposure, fees, and cancellation steps.

Frequently Asked Questions

What does this skill support?

It documents Starknet swaps, DCA orders, STRK staking, market data queries, and related AVNU configuration.

Does it custody my funds?

No. It provides execution examples, but your account and signer control funds.

Can it use gasless swaps?

Yes. The documentation shows AVNU PaymasterRpc configuration and token-based gas payment.

Which networks are documented?

The examples document Starknet mainnet and Sepolia endpoints. Confirm current endpoint status before use.

Does it provide financial advice?

No. It explains technical workflows and does not assess investments, returns, protocol safety, or suitability.

What is the main security concern?

The examples require signing authority and execute state-changing transactions. Isolate keys and require review before every signature.

Developer Details

Author

internet-court

License

Apache-2.0

Author version

v1.0.0

Skillstore revision

Version notice

The installable content changed, but the author did not update the declared version.

Repository

https://github.com/internet-court/internet-court-skill/tree/main/vendored/starknet/starknet-defi

Ref

1c2ebded2116f8124f45dba86a2e567f56e64d8e

Maintenance freshness

8/7/2026

Usage

3 downloads · 0 views

File structure

📁 agents/

📄 openai.yaml

📄 LICENSE

📄 SKILL.md