portkey-ca-agent-skills — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited portkey-ca-agent-skills (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Get* and other read-only contract methods through view-call / callContractViewMethod, not forward-call.forward-call / managerForwardCall only to state-changing methods.Empty-input view methods such as GetConfig, omit params entirely so the runtime performs .call() with no arguments.3002 / Guardian not exist. as an unregistered account and route to register.transfer / cross-chain-transfer, run transfer-preflight to decide whether the path is:recover-and-savemanager-sync-status on the target chaintransferApprove proofstransfer / cross-chain-transfer with loginEmail + passwordAELF and then written on tDVV are a high-risk sync scenario; always check manager-sync-status before the first forward-call / claim / transfer on tDVV.transfer-preflight reports both the transferred asset balance and the chain default fee-token balance (feeSymbol / feeBalance / feeDecimals) when deciding one-time approval eligibility.send-code / verify-code support transferApprove for one-time transfer approval proof collection.transfer, cross-chain-transfer, and transfer-related forward-call accept optional guardiansApproved.transfer, cross-chain-transfer, and generic forward-call now block early when the current manager has not yet synced to the target chain.loginEmail / password / keystoreFile) instead of relying on a previous in-memory unlock.wallet-status returns recommendedAction / userHint when a local keystore exists but is still locked. recommendedAction=unlock is the next machine step; userHint explains how to verify the selected loginEmail / keystoreFile first and then route to recover-and-save only if the password was truly forgotten.VirtualTransactionCreated is forwarded-write evidence only; it is not a decoded view payload and not a standalone proof that a read-only contract query succeeded.bun run mcpbun run portkey_query_skill.ts chain-infobun run portkey_query_skill.ts transfer-preflight --ca-hash <hash> --ca-address <addr> --chain-id tDVV --symbol ELF --amount 100000000bun run portkey_query_skill.ts manager-sync-status --ca-hash <hash> --chain-id tDVV --manager-address <addr-from-recover-and-save-or-selected-signer>portkey_get_active_walletportkey_set_active_walletbun run setup ironclawbun run build:openclawbun run build:openclaw:checkbun run test:coverage:cibunx -p @portkey/ca-agent-skills portkey-ca-setup ironclawbunx -p @portkey/ca-agent-skills portkey-ca-setup openclawportkey-setup was removed in 2.0.0; use portkey-ca-setup for npm-based activation.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.