📦
starknet-js
83使用 starknet.js 构建 Starknet 应用
Starknet 集成需要精确处理提供程序、账户、交易和费用。此技能为 Claude、Codex 和 Claude Code 提供实用的 starknet.js v9 模式。
编码与开发 查看
技能 kleros-ipfs-upload
📦
kleros-ipfs-upload
内容修订 r1 高风险 ⚙️ 外部命令🌐 网络访问🔑 环境变量⚡ 包含脚本📁 文件系统访问
将 Kleros 文件上传到 IPFS
在合约和子图可以使用 Kleros 工件之前，它们需要持久的 IPFS 引用。此技能会向 Kleros x402 网关付款，并返回 CID 和网关 URL。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "kleros-ipfs-upload" from https://skillstore.io/skills/internet-court-kleros-ipfs-upload.md and its manifest at https://skillstore.io/api/skills/internet-court-kleros-ipfs-upload/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“kleros-ipfs-upload”。 将截图作为 Kleros 争议的证据上传。
预期结果:
文件已固定。响应包含 IPFS CID 和该证据的规范 Kleros 网关 URL。
正在使用“kleros-ipfs-upload”。 在进行付费上传前检查网关。
预期结果:
健康检查已通过，发现功能返回了 Base 主网支付条款，未付款上传挑战显示了 x402 强制执行。
正在使用“kleros-ipfs-upload”。 为合约引用固定一份元证据文档。
预期结果:
文档已使用 meta-evidence 操作上传。请在合约或部署工作流中使用返回的 CID。
安全审计
高风险v2 • 2026/7/19 打开版本化报告
Most static alerts are false positives caused by Markdown backticks, TypeScript templates, documented URLs, and URL path text. Confirmed risks involve payment credentials, configurable paid endpoints, unpinned dependencies, and public evidence uploads. No prompt injection attempt was found.
4
已扫描文件
557
分析行数
26
复核项
0
已忽略误报
已确认安全问题 (10)
高
Environment file access
if (process.env.CDP_CREDS_PATH && required.some((k) => !creds[k])) {
This condition enables credential loading from the path in CDP_CREDS_PATH. The following line reads sensitive wallet credentials from that file.
高
Environment file access
const fromFile = await loadEnvFile(process.env.CDP_CREDS_PATH);
The script reads the environment-selected file and parses CDP API and wallet secrets. This is direct access to a sensitive credential file.
高
Crypto seed/private key mention
const privateKey = (
This code normalizes the payer private key for signer construction. The value grants authority to authorize USDC payments.
高
Crypto seed/private key mention
const signer = await createSigner("base", privateKey);
The private key is passed to createSigner for Base payments. This is legitimate functionality with direct financial authority.
高
Environment file access
If you'd rather not pass four env vars on the command line, point `CDP_CREDS_PATH` at a `.env`-style
The instructions recommend storing CDP API and wallet secrets in an environment-style file. No restrictive permission requirement is provided.
高
Crypto seed/private key mention
const signer = await createSigner("base", privateKey);
The example creates a Base signer from a private key. Any process following it receives direct access to a spending credential.
高
Crypto seed/private key mention
node -e "import('viem/accounts').then(m => console.log(m.generatePrivateKey()))"
The command generates a private key and prints it to standard output. Agent logs or terminal capture can retain the secret.
高
Payment Terms Are Not Bounded
Both runners accept GATEWAY_URL and pass its challenge to a payment-enabled fetch. They enforce no origin, amount, token, network, or payee limit before signing.
The source shows an environment-controlled endpoint entering wrapFetchWithPayment without script-side validation. The documented wrapper automatically signs the server challenge.
显示全部 10 条已确认问题
高
No Sensitive Evidence Review
The skill encourages dispute screenshots and documents without requiring a sensitivity review. Uploads go to externally retrievable IPFS and third-party pinning infrastructure.
The documented use cases include evidence files, and the response section provides public gateway URLs. No redaction or confidentiality check is required before upload.
中
Unpinned Payment Dependencies
The skill instructs npm install while dependency versions use caret ranges and no lockfile. Future installs can change code that receives wallet credentials and signs payments.
The package manifest contains caret ranges, and SKILL.md explicitly says the lockfile is omitted so versions stay fresh.
能力复核项 (26)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Generic API/secret keys
* CDP_API_KEY_ID=... CDP_API_KEY_SECRET=... CDP_WALLET_SECRET=... \
The documented invocation places CDP API and wallet secrets directly in a shell command. Real substitutions can persist in shell history or process inspection.
高
Generic API/secret keys
apiKeyId: creds.CDP_API_KEY_ID!,
The CDP API key identifier is loaded into a client that controls a server wallet. It is part of the credential set used for paid requests.
高
Generic API/secret keys
apiKeySecret: creds.CDP_API_KEY_SECRET!,
The script passes the CDP API secret into the wallet client. Compromise of this runtime or dependency can expose a payment credential.
高
Generic API/secret keys
* EVM_PRIVATE_KEY=0x... npx tsx pay-and-upload.ts ./somefile.txt
The documented invocation places an EVM private key directly in a shell command. A real key can persist in shell history or process inspection.
高
Generic API/secret keys
const rawKey = process.env.EVM_PRIVATE_KEY;
The script directly reads the payer private key and later creates a signer from it. This grants the process authority to authorize USDC payments.
高
Generic API/secret keys
EVM_PRIVATE_KEY=0xYourPayerKey npx tsx pay-and-upload.ts /path/to/file.json
The quickstart instructs users to place a payer private key directly in a shell command. Real keys can be retained in command history.
高
Generic API/secret keys
CDP_API_KEY_SECRET=... \
The command template places the CDP API secret directly on the command line. Replacing the placeholder can expose it through shell history.
高
Generic API/secret keys
If you'd rather not pass four env vars on the command line, point `CDP_CREDS_PATH` at a `.env`-style
The skill recommends a file containing CDP API and wallet secrets without requiring restrictive permissions. Weak file permissions could disclose wallet credentials.
高
Generic API/secret keys
EVM_PRIVATE_KEY=0x... npx tsx pay-and-upload.ts hello-world.txt
The paid smoke-test template places the private key in the command line. A real value can be retained in shell history.
高
Generic API/secret keys
CDP_API_KEY_ID=... CDP_API_KEY_SECRET=... CDP_WALLET_SECRET=... \
The CDP smoke-test template places multiple wallet credentials in one shell command. Real values can leak through history or process inspection.
高
Generic API/secret keys
2. Run the bundled script: `EVM_PRIVATE_KEY=0x... npx tsx pay-and-upload.ts /tmp/exhibit-a.png`.
The evidence-upload example places an EVM private key in an inline command. A real key can be retained in shell history.
高
Generic API/secret keys
1. `OPERATION=meta-evidence EVM_PRIVATE_KEY=0x... npx tsx pay-and-upload.ts ./case-42.json`.
The meta-evidence example places an EVM private key in an inline command. A real key can be retained in shell history.
低
Hardcoded URL
process.env.GATEWAY_URL ?? "https://kleros-ipfs-gateway.fly.dev";
The executable defaults to this external host and later sends file data through a payment-enabled fetch. The network exposure is intentional but real.
低
Environment variable access (bracket notation)
for (const key of required) creds[key] = process.env[key];
The loop reads named CDP credentials from the process environment. This is required functionality, but it gives the script access to payment secrets.
低
Environment variable access (dot notation)
if (process.env.CDP_CREDS_PATH && required.some((k) => !creds[k])) {
CDP_CREDS_PATH controls whether the script loads credentials from a local file. A modified environment can redirect secret loading to another readable path.
低
Environment variable access (dot notation)
const fromFile = await loadEnvFile(process.env.CDP_CREDS_PATH);
The environment value is passed directly to the credential-file loader. This is intentional, but it selects a local file containing payment secrets.
低
Environment variable access (dot notation)
process.env.GATEWAY_URL ?? "https://kleros-ipfs-gateway.fly.dev";
GATEWAY_URL can redirect both the uploaded file and the payment-enabled request. The script does not constrain the configured origin.
低
Environment variable object
for (const key of required) creds[key] = process.env[key];
The loop reads named CDP credentials from the process environment. This is required functionality, but it gives the script access to payment secrets.
低
Environment variable object
if (process.env.CDP_CREDS_PATH && required.some((k) => !creds[k])) {
CDP_CREDS_PATH controls whether the script loads credentials from a local file. A modified environment can redirect secret loading to another readable path.
低
Environment variable object
const fromFile = await loadEnvFile(process.env.CDP_CREDS_PATH);
The environment value is passed directly to the credential-file loader. This is intentional, but it selects a local file containing payment secrets.
低
Environment variable object
process.env.GATEWAY_URL ?? "https://kleros-ipfs-gateway.fly.dev";
GATEWAY_URL can redirect both the uploaded file and the payment-enabled request. The script does not constrain the configured origin.
低
Hardcoded URL
process.env.GATEWAY_URL ?? "https://kleros-ipfs-gateway.fly.dev";
The executable defaults to this external host and later sends file data through a payment-enabled fetch. The network exposure is intentional but real.
低
Environment variable access (dot notation)
const rawKey = process.env.EVM_PRIVATE_KEY;
The script reads EVM_PRIVATE_KEY from the environment and later uses it to create a payment signer. This is direct access to a spending credential.
低
Environment variable access (dot notation)
process.env.GATEWAY_URL ?? "https://kleros-ipfs-gateway.fly.dev";
GATEWAY_URL can redirect both the uploaded file and the payment-enabled request. The script does not constrain the configured origin.
低
Environment variable object
const rawKey = process.env.EVM_PRIVATE_KEY;
The script reads EVM_PRIVATE_KEY from the environment and later uses it to create a payment signer. This is direct access to a spending credential.
低
Environment variable object
process.env.GATEWAY_URL ?? "https://kleros-ipfs-gateway.fly.dev";
GATEWAY_URL can redirect both the uploaded file and the payment-enabled request. The script does not constrain the configured origin.
风险因素
⚙️ 外部命令 (50)
scripts/pay-and-upload-cdp.ts:7 scripts/pay-and-upload-cdp.ts:8 scripts/pay-and-upload-cdp.ts:82 scripts/pay-and-upload-cdp.ts:99 scripts/pay-and-upload-cdp.ts:113 scripts/pay-and-upload-cdp.ts:118 scripts/pay-and-upload-cdp.ts:131-133 scripts/pay-and-upload-cdp.ts:134 scripts/pay-and-upload-cdp.ts:138 scripts/pay-and-upload-cdp.ts:154 scripts/pay-and-upload-cdp.ts:158 scripts/pay-and-upload-cdp.ts:32 scripts/pay-and-upload-cdp.ts:8-82 scripts/pay-and-upload.ts:38 scripts/pay-and-upload.ts:39 scripts/pay-and-upload.ts:56-58 scripts/pay-and-upload.ts:59 scripts/pay-and-upload.ts:65 scripts/pay-and-upload.ts:66 scripts/pay-and-upload.ts:79 scripts/pay-and-upload.ts:83 SKILL.md:17 SKILL.md:31 SKILL.md:46 SKILL.md:47 SKILL.md:49-53 SKILL.md:53-55 SKILL.md:55 SKILL.md:57-59 SKILL.md:59 SKILL.md:63-74 SKILL.md:74-75 SKILL.md:75-78 SKILL.md:78-80 SKILL.md:80 SKILL.md:84-86 SKILL.md:86-99 SKILL.md:99-105 SKILL.md:105-115 SKILL.md:115-117 SKILL.md:117-119 SKILL.md:119-123 SKILL.md:123 SKILL.md:125 SKILL.md:127-135 SKILL.md:135-137 SKILL.md:137-139 SKILL.md:139 SKILL.md:143-151 SKILL.md:151-157
🌐 网络访问 (18)
🔑 环境变量 (40)
scripts/pay-and-upload-cdp.ts:66 scripts/pay-and-upload-cdp.ts:68 scripts/pay-and-upload-cdp.ts:69 scripts/pay-and-upload-cdp.ts:89 scripts/pay-and-upload-cdp.ts:90 scripts/pay-and-upload-cdp.ts:66 scripts/pay-and-upload-cdp.ts:68 scripts/pay-and-upload-cdp.ts:69 scripts/pay-and-upload-cdp.ts:89 scripts/pay-and-upload-cdp.ts:90 scripts/pay-and-upload-cdp.ts:16 scripts/pay-and-upload-cdp.ts:20 scripts/pay-and-upload-cdp.ts:21 scripts/pay-and-upload-cdp.ts:59 scripts/pay-and-upload-cdp.ts:60 scripts/pay-and-upload-cdp.ts:72 scripts/pay-and-upload-cdp.ts:73 scripts/pay-and-upload-cdp.ts:93 scripts/pay-and-upload-cdp.ts:94 scripts/pay-and-upload.ts:32 scripts/pay-and-upload.ts:42 scripts/pay-and-upload.ts:43 scripts/pay-and-upload.ts:32 scripts/pay-and-upload.ts:42 scripts/pay-and-upload.ts:43 scripts/pay-and-upload.ts:11 scripts/pay-and-upload.ts:14 scripts/pay-and-upload.ts:32 scripts/pay-and-upload.ts:34 SKILL.md:66 SKILL.md:66 SKILL.md:52 SKILL.md:119 SKILL.md:130 SKILL.md:131 SKILL.md:139 SKILL.md:240 SKILL.md:243 SKILL.md:266 SKILL.md:274
⚡ 包含脚本 (1)
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/internet-court-kleros-ipfs-upload/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/internet-court-kleros-ipfs-upload?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/internet-court-kleros-ipfs-upload?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-kleros-ipfs-upload/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/internet-court-kleros-ipfs-upload.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
internet-court. (2026). kleros-ipfs-upload security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/internet-court-kleros-ipfs-upload/audits/2BibTeX 引用
@techreport{internet-court-internet-court-kleros-ipfs-upload-2026,
author = {internet-court},
title = {kleros-ipfs-upload security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/internet-court-kleros-ipfs-upload/audits/2},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "kleros-ipfs-upload security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
- name: "internet-court"
date-released: "2026-07-19"
url: "https://skillstore.io/skills/internet-court-kleros-ipfs-upload/audits/2"
identifiers:
- type: other
value: "skillstore:internet-court-kleros-ipfs-upload:audit:2"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 45
架构
85
可维护性
87
内容
65
社区
91
规范符合性
你能构建什么
附加争议证据
上传截图、合同或支持性文档，并获取适用于 Kleros 争议提交的 URL。
发布元证据
在从合约、事件或部署脚本引用其 CID 之前，固定政策或案件元数据文件。
验证网关就绪状态
在依赖付费上传之前，检查网关健康状况、x402 发现元数据、支付网络和预期价格。
试试这些提示
上传证据文件
使用此技能将我选定的文件作为 Kleros 争议证据上传。确认费用、检查网关，然后返回 CID 和 URL。
固定元证据
为 Kleros 案件固定我的元证据文件。使用 meta-evidence 操作，并说明我应在链上存储哪个 CID。
运行免费网关检查
仅运行免费的 Kleros IPFS 网关检查。报告 x402 价格、网络、收款方，以及是否应继续进行付费上传。
使用 CDP 服务器凭据
使用 Coinbase CDP 服务器账户在一次付费请求中上传这些 Kleros 工件。确认凭据、预期支出和 CID 一致性。
最佳实践
- 在任何付费上传前确认文件路径、操作标签、价格和网络。
- 使用资金最少的钱包或权限受限的 CDP 账户支付上传费用。
- 在花费 USDC 前运行免费的健康检查和发现检查。
避免
- 没有 Kleros 需求时，不要将此网关用于通用 IPFS 存储。
- 不要在共享代理环境中放置长期有效的私钥。
- 当一个成功的 CID 已足够时，不要反复重试付费上传。
常见问题
此技能上传什么内容？
它上传 Kleros 生态系统文件，例如证据、元证据、政策、元数据和陪审员理由说明。
需要花钱吗？
是。每次成功的付费上传都会通过 x402 支付流程在 Base 主网上花费 USDC。
支持哪些钱包类型？
随附的运行器支持原始 EVM 私钥或 Coinbase CDP 服务器账户。
可以上传大文件吗？
不支持。文档中规定的网关限制是总 multipart 请求正文为 4 MiB。
我可以将它用于非 Kleros 的 IPFS 存储吗？
对于不具有 Kleros 用途的通用 IPFS 存储，此技能建议使用其他固定服务提供商。
我应预期获得什么输出？
成功上传会返回 IPFS CID 和 Kleros 网关 URL，可供其他系统共享或引用。
开发者详情
许可证
MIT
Skillstore 修订
r1
版本提示
作者未声明版本。
仓库
https://github.com/internet-court/internet-court-skill/tree/main/vendored/kleros/kleros-ipfs-upload引用
3f6e026a3363e0954ede7bef0cfe88d4475de137
维护新鲜度
2026/7/20
使用量
1 次下载 · 0 次浏览
文件结构
internet-court 的更多技能
查看全部📦
chaingpt
78构建 ChainGPT Web3 AI 应用
Web3 开发者在编写集成代码之前，需要清晰了解 ChainGPT 产品的 API 使用指南。本技能总结了 ChainGPT 驱动型应用的端点、SDK、成本和实现模式。
编码与开发 查看
📦
nansen-wallet-profiler
77分析 Nansen 钱包档案
钱包调查需要针对余额、标签、PnL 和关联关系重复执行许多 Nansen CLI 调用。此技能为 Claude、Codex 和 Claude Code 用户组织这些工作流。
数据与分析 查看
📦
nansen-token-research
77使用 Nansen 研究代币
代币分析师需要可重复执行的命令，以开展深入的链上和市场研究。此技能可指导 Claude、Codex 和 Claude Code 使用 Nansen CLI 工作流分析持有者、资金流、交易、PnL 和永续合约。
研究与学习 查看
📦
nansen-smart-money-tracker
77追踪聪明钱钱包活动
加密货币分析师需要快速了解知名钱包买入、卖出和持有哪些资产。此技能可指导 Claude、Codex 和 Claude Code 使用 Nansen smart money CLI 进行查询。
数据与分析 查看
📦
nansen-holder-analysis
77分析 Nansen 代币持有者质量
代币团队需要了解持有者是高质量钱包还是短期散户资金流。此技能使用 Nansen CLI 命令来比较聪明钱持有者、标签资金流和买方质量。
研究与学习 查看
相关技能
查看全部📦
automation-integration-preflight-action
80Audit Webpages for Integration Readiness
由 tinyopsstudio
Teams need reliable evidence before investing in web automation or integrations. This skill checks public pages through TinyOps and returns readiness findings, risks, and acceptance guidance.
DevOps 与基础设施 查看
📦
verification-protocol
80用证据验证智能体完成情况
由 CleanExpo
AI 智能体可能在没有证明的情况下将工作标记为完成，从而产生虚假完成风险。此技能要求在接受任务完成之前提供独立证据。
效率 查看
📦
analysis-tree
77Map Your Data Analysis Reasoning
由 crystal-cat2
Complex data investigations lose context when questions, evidence, and conclusions remain scattered. This skill maintains them in one evolving analysis tree.
数据与分析 查看
📦
yelp
69Search Yelp Businesses and Reviews
由 fetcher-sh
Local business research requires searching listings and gathering details and reviews. This skill documents paid fetcher.sh requests for these tasks through HTTP and MCP.
研究与学习 查看
📦
tiktok-api
67Explore TikTok Data with Fetcher.sh
由 fetcher-sh
Official TikTok access can require application review and does not fit quick, read-only research. This skill guides paid Fetcher.sh requests for posts, profiles, comments, and discovery feeds.
数据与分析 查看
📦
twitter-api
50Access Twitter and X Data
由 fetcher-sh
Official X access can require developer approval, OAuth setup, and fixed pricing tiers. This skill provides paid, read-only REST and MCP access through fetcher.sh.
研究与学习 查看