up2itnow0822 e57ad5c33d fix: address all automated review feedback on code example ...

Security model:
- Remove set_policy from agent-callable tools table; document as
  orchestrator-only to prevent self-privilege escalation
- Pin agentwallet-sdk@6.0.0 in MCP config with pre-install guidance
  (npx without -y hangs in non-interactive MCP startup)
- Whitelist only required env vars (PATH, NODE_ENV, WALLET_PRIVATE_KEY)
  instead of forwarding entire process.env to subprocess

Code example (complete rewrite):
- Add StdioClientTransport import and client.connect() for runnable code
- Wrap in async main() for CJS/ESM compatibility (top-level await)
- Verify set_policy result via isError before delegating
- Five distinct fail-closed error paths in preToolCheck:
  1. Invalid apiCost input (NaN/Infinity bypass prevention)
  2. Transport/connectivity failure
  3. Tool-level error (isError: true, e.g., auth failure)
  4. Unexpected response format (missing/non-finite remaining)
  5. Budget exceeded (clear amounts in message)
- Use Number.isFinite() for both apiCost and remaining validation

Documentation:
- Rename headings per CONTRIBUTING.md format
- Replace broken mcp-server-patterns cross-ref with security-review
- Add 'Pin your dependencies' to Best Practices
- Add security note about supply-chain risk

2026-03-24 15:36:31 -05:00

..

SKILL.md

fix: address all automated review feedback on code example

2026-03-24 15:36:31 -05:00