aomi-transact-cd9ca3 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited aomi-transact-cd9ca3 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use the TypeScript aomi CLI to prepare, review and execute user-authorized transactions. The Rust aomi-cli in product-mono has a different interface.
first. Check package availability and installed help; a source test or SDK migration message does not prove a working published CLI. Stop a missing capability branch with its release requirement; keep a working older binary.
chain ID and token contract. Read the user's wallet catalog for operational addresses and known funded chains. Check live token and native gas balances across those positions before preparing a payment. A zero Ethereum USDC balance is not a wallet-wide shortfall. Use tx preflight when available; follow funding checks otherwise. Keep a treasury/Safe refill as a separately authorized source choice.
asset/chain, amount, recipient, estimated fees and shortfall. For conversion or bridging, obtain a fresh quote with minimum destination output, gas on each leg and route fees. USDC and USDG are different contracts/assets. Finish this step with unambiguous, funded terms before building a payment.
--public-key <sender> --chain <chain-id>. Continue its original session on follow-ups. Read aomi tx list --json, retain the full Commit ID and export that exact Commit with aomi tx export <commit-id> --format commit`.
chain, token, amount, recipient, calldata, fees and simulation. Check all legs and approval limits. Simulation for a Commit lives in its review; tx simulate is a separate legacy Action tool. Require passed simulation for execution.
aomi tx sign <commit-id> only withinthe user's authorization and an available designated signer. For an external signer, preserve the exact export and report the signed payloads or prepared broadcast hash through tx submit; see workflows.md. Inspect prepared AA payloads before choosing the signing path; see account-abstraction.md.
approved intent and transaction hash together. Refresh that Commit with aomi tx list --json before retrying; the backend observes the receipt and moves it to confirmed. A known hash or outstanding wallet attempt calls for reconciliation, not a new signing attempt. Report preparation, simulation, signature, submission and confirmation separately. Bridge completion also needs the destination receipt and spendable output token.
Use the existing authorized signer without exposing key material. Credential setup is a separate user-directed operation; values stay opaque and out of chat, logs, fixtures and exported payment records. ~/.aomi may contain signing keys, bearers and secret handles. Its permission manifest expresses intended scope; actual enforcement depends on the host. For credential handling, local state and recovery, read gotchas.md and session.md.
capabilities and this procedure take precedence over historical app examples.
Source: https://github.com/aomi-labs/skills/tree/main/aomi-transact
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.