goldrush-api — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited goldrush-api (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
GoldRush by Covalent provides blockchain data across 100+ chains through a unified REST API, real-time WebSocket streams, a CLI, and an x402 pay-per-request proxy. This skill enables AI agents to query wallet balances, token prices, transaction history, NFT holdings, and DEX pair data without building chain-specific integrations.
Sign up at https://goldrush.dev for a free API key. For agent-native no-signup access, use the x402 proxy instead.
export GOLDRUSH_API_KEY="your_api_key_here"REST API (most endpoints):
# Wallet token balances on Ethereum
curl -H "Authorization: Bearer $GOLDRUSH_API_KEY" "https://api.covalenthq.com/v1/eth-mainnet/address/0xADDRESS/balances_v2/"CLI (quick terminal queries):
npx @covalenthq/goldrush-cli balances --chain eth-mainnet --address 0xADDRESSSDK (in code):
import GoldRushClient from "@covalenthq/client-sdk";
const client = new GoldRushClient(process.env.GOLDRUSH_API_KEY);
const resp = await client.BalanceService.getTokenBalancesForWalletAddress(
"eth-mainnet", "0xADDRESS"
);curl -H "Authorization: Bearer $GOLDRUSH_API_KEY" "https://api.covalenthq.com/v1/eth-mainnet/address/0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045/balances_v2/"curl -H "Authorization: Bearer $GOLDRUSH_API_KEY" "https://api.covalenthq.com/v1/pricing/historical_by_addresses_v2/eth-mainnet/USD/0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48/"curl -H "Authorization: Bearer $GOLDRUSH_API_KEY" "https://api.covalenthq.com/v1/eth-mainnet/address/0xADDRESS/transactions_v3/"// Stream live price candles for a token pair
const ws = new WebSocket("wss://streaming.covalenthq.com/v1/eth-mainnet/ohlcv");
ws.on("message", (data) => console.log(JSON.parse(data)));✅ Use chain slugs: eth-mainnet, matic-mainnet, base-mainnet, bsc-mainnet — full list at https://goldrush.dev/docs/networks ✅ Store API key in GOLDRUSH_API_KEY env var — never hardcode ✅ Use WebSocket streams for real-time data rather than polling REST ✅ Use SDK cursor pagination for large result sets ❌ Don't use x402 for high-volume use cases — get a standard API key instead ❌ Don't use chain IDs (e.g., 1) — use chain slugs (e.g., eth-mainnet)
GOLDRUSH_API_KEY environment variable onlyProblem: 401 Unauthorized Solution: Ensure API key is in Authorization: Bearer header, not query string
Problem: chain_name not found Solution: Use chain slug format — see https://goldrush.dev/docs/networks
Problem: Empty results for new wallet Solution: Some endpoints require on-chain activity; new wallets with no transactions return empty arrays, not errors
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.