Audit History

The static findings are predominantly false positives caused by Markdown code fences, documentation URLs, examples, and standard configuration syntax. The private-key signer example is a confirmed high-impact secret-handling risk, so publication requires author remediation.

Static detections are false positives caused by Markdown code formatting, documentation links, and illustrative configuration. The skill contains expected on-chain transaction examples, but it does not provide adequate safeguards before signed writes are broadcast.

Most static alerts are Markdown formatting, reference links, example URLs, or standard A2A discovery paths. I confirmed one high-risk issue: the account setup example uses a privateKey signer without explicit key-management guidance. No evidence found of prompt injection, credential exfiltration, hidden downloads, or malicious system reconnaissance.