Audit History

The static catalog is mostly false positive noise from Markdown fences, documentation URLs, configuration examples, and a relative documentation link. The required signing key is a genuine high-risk credential, and the transaction examples lack an explicit confirmation and safety-control layer.

All 56 static findings are false positives caused by Markdown formatting, documented endpoints, or named configuration reads. The skill has one confirmed financial-safety concern: it can retry a failed swap with doubled slippage without renewed approval. No prompt injection or credential-exfiltration intent was found.

Most static command findings are false positives caused by Markdown code fences and inline code. The meaningful risks are the skill's use of a funded Starknet private key, real DeFi transaction execution, external AVNU endpoints, and an example that retries swaps with higher slippage.