Audit History

All 99 static findings are false positives after contextual review. The matches describe documentation syntax, public RPC examples, relative references, standard configuration access, or intentional environment-based key loading; no command execution, exfiltration, or prompt injection was identified.

All 99 static findings are false positives: they identify Markdown fences, documentation links, public endpoint examples, normal signer handling, or non-sensitive configuration access. No prompt injection, secret exfiltration, command execution, or hidden network behavior was found. The documentation should add consistent user-confirmation guidance before state-changing transactions.

AI review confirmed six static findings in scripts/account-example.ts related to environment access and raw Starknet private-key handling. The remaining static findings are false positives from Markdown formatting, documentation URLs, reference links, or normal Starknet API examples, and no prompt injection was found. One semantic finding notes overbroad tool permissions in the skill metadata.