mcpField
F
feast-audit

feast-audit

github.com/feastmemeSecurity07 installsUpdated 1d ago
Repository

About feast-audit

feast-audit is a skill for auditing Feast League strategy scripts before they run with a user’s funds. It combines deterministic static checks bound to the file’s SHA-256 with a model review against a checklist, and refuses startup unless both stages pass.

Key features

  1. 01Run deterministic static audit rules
  2. 02Bind audit stages to file SHA-256
  3. 03Review script against a checklist
  4. 04Record pass or refuse verdict
  5. 05Require both stages before startup

Use cases

  1. 01Check a strategy script before execution
  2. 02Identify unsafe trading behavior
  3. 03Review a script after editing

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/feastmeme/feast-agent --skill feast-audit

After installing, type/feast-auditin Claude Code to confirm it loaded.

Bundled filesreferences/checklist.md

Details

From the project README

Feast script audit

A strategy script runs with the user's money, so it passes two stages first. Both are bound to the file's sha256: any edit is a new file and needs a new audit.

FL is the runtime's command, as in the feast-league skill:

node "${FEAST_LEAGUE_RUNTIME:-$HOME/.feast-league/runtime}/src/league/bin.mjs"

Stage 1: the static rules (deterministic)

FL audit <file.mjs>

The runtime parses the file; it never runs it.

RuleRefuses
A1any direct wallet or process access: baw, child processes, process, workers
A2imports of any kind: import, import(), require, import.meta
A3network: fetch, sockets, URLs to any host but feast.meme
A4secrets: key-shaped hex, seed-phrase-shaped words, API keys, key files
A5dynamic code and reaching for globals: eval, Function, globalThis, constructor, __proto__, keys it cannot read
A6unbounded loops (while, unbounded for, recursion) and timers
A7the wrong shape: other exports, a tick outside 15–3600 s, code at the top level, over 64 KB
A8any api member but buy, sell, launch, read.*, state, params, log
A9(a warning) literal sizes over the per-trade limit

If it refuses:

  1. Show every hit with its rule and line.
  2. Stop.
  3. If you wrote the script, offer to fix it and audit again. Do not argue a rule away.

Stage 2: your model read

Before you start:

  • Read the whole file yourself, against references/checklist.md.
  • Answer every question in writing, in a few lines each.
  • Be the user's advocate. You are looking for a script that would surprise them with their own money.
  • Code you wrote yourself gets no exemption.

Record the verdict:

FL audit <file.mjs> --model-verdict pass --notes "M1: … M2: … M3: … M4: … M5: … M6: … M7: … M8: …"
FL audit <file.mjs> --model-verdict refuse --notes "M2: buys on every tick with no condition …"

Refuse when any answer is a real concern:

  • it trades more than the user asked
  • it has no exit
  • it is obfuscated
  • it does something the user did not ask for

Then tell the user in two sentences what the script does, and whether it passed.

Then

A script with both stages passed can be planned and started (see the feast-league skill). It runs in the warm-up tier:

  • its first 5 trades are at 0.001 BNB
  • two failures in a row, or any hard-limit hit, stop it and notify the user

The runtime refuses to start a script whose current bytes lack either pass.

Comments

Markdown supported