AntFleet

Disagreement · 8dbec532-anthropic-2

Wallet SKILL Quick start contradicts the documented hardening (omits PRIVY_AUTH_SIGNING_KEY)

solo Opus
repo a16d2030·PR #2·reviewed 1 week ago

Opus finding

Wallet SKILL Quick start contradicts the documented hardening (omits PRIVY_AUTH_SIGNING_KEY)

mediumdocs-gaphigh
  • opensea/opensea-wallet/SKILL.md:67-82
  • opensea/opensea-wallet/references/wallet-setup.md:60-75
  • opensea/opensea-wallet/references/wallet-setup.md:41-50
The wallet SKILL.md presents the Privy Quick Start without `PRIVY_AUTH_SIGNING_KEY`, then later in references/wallet-setup.md describes registering an authorization key and additional_signer as part of the happy path (not optional). A user following only the Quick Start lands in exactly the unhardened state the rest of the doc warns is a security gap. Quick-Start examples become the default copy-paste recipe; this one trains users to deploy with the very property the security model says must not hold.

Recommendation

Either include PRIVY_AUTH_SIGNING_KEY in the Quick Start with a one-line note pointing to the key-generation snippet in wallet-setup.md, or replace the Quick Start with a 'minimum viable hardened setup' that matches the security model the SKILL claims to enforce.

Other reviewer

The other reviewer flagged nothing in this file/line range.

Why this didn't post

This finding didn't meet AntFleet's unanimous agreement threshold. Both frontier models review every PR independently; only findings they both flag with the same severity and category are posted to the PR. This one fell through.

read the methodology →