Security audit
Security checks for vulnerabilities and agentic risk
This is a small wallet-address format checker with no evidence of exfiltration, persistence, destructive behavior, or hidden execution.
Before relying on this for transfers, treat it as a basic format pre-check only. It does not fully verify EIP-55, Base58 checksums, or chain ownership, so high-value transfers still need wallet or exchange confirmation and a small test transfer. Installers may also want to narrow the declared agent tools because Write and WebFetch are broader than the script needs.
This file imposes a specific language/locale on users or maintainers through its natural-language instructions. Under the policy, forcing a language without offering user choice or documenting a justified locale constraint is a reportable issue.
The top-level manifest description is written in Chinese only, while this skill is otherwise bilingual. Presenting the primary description in a fixed language without offering user choice can violate language/locale policy expectations for multilingual users.
L06 describes the skill's role as a narrowly scoped address format checker, which implies validation behavior rather than repository editing. Later, L27 explicitly permits changing the skill's own documentation, scripts, and configuration, creating an intent-level mismatch between the claimed skill behavior and the documented agent actions.
The file is explicitly bilingual in Chinese and English, but it does not state that users may choose their preferred language or that the locale scope is intentionally limited. Under the policy rule, forcing or assuming a specific language set without user opt-in can be a natural-language policy concern.
This code presents its description and runtime output in Chinese only, including the argparse description and printed status messages. That creates a language/locale constraint without any user opt-in or alternative, which matches the policy-violation category for forced language use.
