@polygonlabs/agent-cli
CLI + Agent Skills for building on-chain agents on Polygon
14
Versions
—
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
devops-polygon.technologymtwardzickimaximushaximusshan8851vojtechvitektaylanpincepy-zoid
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): Polymarket SDK v2 migration, consistent with package's stated trading functionality. | ai | |
| provenance | missing-githead | AI (provenance): CI-published with SLSA attestation; gitHead gap looks like pipeline change, not takeover. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Org-level maintainer list cleanup under continued CI/Sigstore-attested publishing. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Package published via CI/CD with SLSA provenance under official 0xPolygon org; team expansion is expected for an active project. | ai | |
| phantom-deps | phantom-dep:@noble/curves | AI (phantom-deps): Likely transitive/config dependency for crypto operations; stable for this package. | ai | |
| phantom-deps | phantom-dep:@noble/ciphers | AI (phantom-deps): Likely transitive/config dependency for crypto operations; stable for this package. | ai | |
| phantom-deps | phantom-dep:@noble/hashes | AI (phantom-deps): Likely transitive/config dependency for crypto operations; stable for this package. | ai | |
| dependencies | unvetted-dep:ethers5 | AI (dependencies): ethers5 is a well-known alias for ethers v5; standard pattern in Web3 projects needing dual ethers versions. | ai | |
| phantom-deps | phantom-dep:@0xsequence/wallet-core | AI (phantom-deps): Part of 0xsequence suite; declared dep, stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:dotenv | AI (phantom-deps): CLI tool; dotenv declared for config, may be loaded conditionally or transitively. | ai | |
| phantom-deps | phantom-dep:@0xsequence/wallet-primitives | AI (phantom-deps): Part of 0xsequence suite; declared dep, stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:tweetnacl | AI (phantom-deps): Crypto utility declared as dep; likely used indirectly or conditionally in CLI. | ai | |
| phantom-deps | phantom-dep:@x402/core | AI (phantom-deps): Declared dep in package.json; phantom-dep heuristic false positive for this package. | ai | |
| phantom-deps | phantom-dep:@0xsequence/abi | AI (phantom-deps): Part of 0xsequence suite; declared dep, stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@0xsequence/api | AI (phantom-deps): Part of 0xsequence suite; declared dep, stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@0xsequence/builder | AI (phantom-deps): Part of 0xsequence suite; declared dep, stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@0xsequence/relayer | AI (phantom-deps): Part of 0xsequence suite; declared dep, stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@0xsequence/wallet-wdk | AI (phantom-deps): Part of 0xsequence suite; declared dep, stable false positive for this package. | ai |
Versions (showing 14 of 14)
| Version | Deps | Published |
|---|---|---|
| 0.13.0 | 17 / 4 | |
| 0.11.0 | 31 / 4 | |
| 0.10.4 | 31 / 4 | |
| 0.10.2 | 31 / 4 | |
| 0.10.0 | 31 / 4 | |
| 0.9.5 | 32 / 4 | |
| 0.9.4 | 32 / 4 | |
| 0.9.0 | 32 / 4 | |
| 0.8.0 | 32 / 4 | |
| 0.7.2 | 32 / 4 | |
| 0.7.0 | 33 / 2 | |
| 0.3.0 | 25 / 1 | |
| 0.2.2 | 21 / 1 | |
| 0.2.1 | 21 / 1 |
v0.13.0
2 findings
HIGH
Missing gitHead — previous versions had it
provenance
This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.10.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.9.4
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.