Agentkit Actions

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  src/floeAgent.ts, line 386

  async fetch(input: string | X402FetchInput): Promise<FetchResult> {

  src/floeAgent.ts, line 493

  return this.fetch(input);

  src/floeAgent.ts, line 498

  * spend ↔ outcome loop. Pair with `fetch({ actionId })`: tag your paid

  Show more

  src/floeAgent.ts, line 501

  * await agent.fetch({ url, actionId: 'summarize-doc-42' });

  src/floeAgent.ts, line 579

  * await agent.fetch({ url, taskId: 'call-8821' });

  src/floeAgent.ts, line 767

  * Use this after `fetch()` throws with `code: "upstream_paid_request_failed_ambiguous"` -

  src/floeAgent.ts, line 908

  return await fetch(`${this.baseUrl}${path}`, {

  src/x402ActionProvider.ts, line 91

  url: z.string().url().describe("The URL to fetch (may require x402 payment)"),

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  examples/chatbot.ts, line 12

  * cp .env.example .env # fill in your keys

  examples/chatbot.ts, line 18

  dotenv.config({ path: path.resolve(import.meta.dirname, ".env") });

  examples/chatbot.ts, line 30

  const CDP_API_KEY_NAME = process.env.CDP_API_KEY_NAME;

  Show more

  examples/chatbot.ts, line 31

  const CDP_API_KEY_PRIVATE_KEY = process.env.CDP_API_KEY_PRIVATE_KEY;

  examples/chatbot.ts, line 32

  const OPENAI_API_KEY = process.env.OPENAI_API_KEY;

  examples/chatbot.ts, line 38

  console.error("Copy .env.example to .env and fill in your keys.");

  examples/standalone.ts, line 11

  * cp .env.example .env # fill in your wallet key

  examples/standalone.ts, line 17

  dotenv.config({ path: path.resolve(import.meta.dirname, ".env") });

  examples/standalone.ts, line 27

  const PRIVATE_KEY = process.env.PRIVATE_KEY as `0x${string}`;

  examples/standalone.ts, line 31

  console.error("Copy .env.example to .env and fill in your wallet key.");

  src/cli/aiFactory.ts, line 15

  const apiKey = config.apiKey || process.env.OPENAI_API_KEY;

  src/cli/aiFactory.ts, line 26

  const apiKey = config.apiKey || process.env.ANTHROPIC_API_KEY;

  src/cli/devApiClient.ts, line 100

  const envKey = process.env.FLOE_API_KEY?.trim();

  src/cli/devApiClient.ts, line 104

  const pk = process.env.PRIVATE_KEY?.trim();

  .gitignore, line 2

  dist/

  .gitignore, line 3

  .env

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Concern

  contains an encoded blob in a file that should be readable.

  OBFUSCATION_ENCODED_BLOB

  src/flashArbBytecode.ts, line 4

  "0x60c0346101c257601f61154638819003918201601f19168301916001600160401b038311848410176101c6578084926060946040528339810103126101c257610047816101da565b610053602083016101da565b916001600

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 9294f4fcd513. can reach a host that is not written as a fixed address. reads a credential or environment file. contains an encoded blob in a file that should be readable.

Date and source

Date checked: 23 Oct 2026

Read how this letter is chosen