{
  "projectId": "goat",
  "title": "GOAT SDK 的插件工具注册机制",
  "summary": "GOAT 核心是把插件方法与钱包操作包装成模型可调用工具的适配层，交易能力由钱包实现与外部插件提供。",
  "scope": "npm @goat-sdk/core@0.5.0 的选定发布文件；REA 解析 4 个 JS 文件，静态分析。",
  "status": "partial",
  "analyzedAt": "2026-10-13T10:35:19.988132+00:00",
  "tool": {
    "name": "REA",
    "version": "6.4.0"
  },
  "findings": [
    {
      "title": "装饰器元数据生成工具调用",
      "detail": "Tool 装饰器记录方法、描述和 Zod 参数；PluginBase.getTools 读取元数据，按参数位置注入 walletClient，再调用原始方法。",
      "evidenceType": "code_inference",
      "evidenceIds": [
        "ev_e70adc800873324b2911e0426b7d5b1e1498e10cb3e1bc16c9e082a8feb8538d"
      ],
      "sourceUrls": [
        "https://registry.npmjs.org/@goat-sdk/core/-/core-0.5.0.tgz"
      ]
    },
    {
      "title": "基础钱包工具也包含签名能力",
      "detail": "WalletClientBase 的核心工具列出 get_address、get_chain、get_balance 和 sign_message。实际签名交给具体钱包，因此接入时仍需确认钱包和宿主的权限。",
      "evidenceType": "observed",
      "evidenceIds": [
        "ev_e70adc800873324b2911e0426b7d5b1e1498e10cb3e1bc16c9e082a8feb8538d"
      ],
      "sourceUrls": [
        "https://registry.npmjs.org/@goat-sdk/core/-/core-0.5.0.tgz"
      ]
    }
  ],
  "limitations": [
    "选取四个核心发行块，未覆盖全部插件或第三方钱包。",
    "未验证模型调用意图与钱包确认是否绑定。",
    "静态代码不证明运行行为、完整风控、成交或收益；未审计服务端。",
    "没有登录、读取账户、连接钱包、签名、交易或执行目标代码。"
  ],
  "artifacts": [
    {
      "label": "@goat-sdk/core@0.5.0",
      "url": "https://registry.npmjs.org/@goat-sdk/core/-/core-0.5.0.tgz",
      "sha256": "0fc08c8ca6433b6de02f4a2729ef9d259b65ec0ccd849507748b47dfb5e63576"
    },
    {
      "label": "dist--chunk-PRWXN5RN.js",
      "url": "https://registry.npmjs.org/@goat-sdk/core/-/core-0.5.0.tgz",
      "sha256": "c83446ca1e739f0ee3d3cf07702a740a18cee2d9c0d5783f3997e0c08ec8e94a"
    },
    {
      "label": "dist--chunk-YNASICHO.js",
      "url": "https://registry.npmjs.org/@goat-sdk/core/-/core-0.5.0.tgz",
      "sha256": "2c1ec977c7bcaeb2cb0cf9621511085b73d2557cfcf43dec4665ffa27ddb5fa2"
    },
    {
      "label": "dist--chunk-NEB5NRY6.js",
      "url": "https://registry.npmjs.org/@goat-sdk/core/-/core-0.5.0.tgz",
      "sha256": "b488c8f64eb53bc1385e2818c1f9fea1bc25ca6ccff603e17f65151a716157c8"
    },
    {
      "label": "dist--index.js",
      "url": "https://registry.npmjs.org/@goat-sdk/core/-/core-0.5.0.tgz",
      "sha256": "040067f343e1c9d3ad686cd3cb75aa58ec4c85d8b8102f65900f47f522263ba8"
    }
  ],
  "evidenceIds": [
    "ev_e70adc800873324b2911e0426b7d5b1e1498e10cb3e1bc16c9e082a8feb8538d"
  ],
  "reportUrl": "/research/rea/goat.json",
  "coverage": {
    "parsedFiles": 4,
    "parseFailures": 0,
    "semanticCoverage": "unknown",
    "rootArtifactSha256": "b88ff58906bb4307266db8dea4215d9fac1426320a867fba129a0d7d0cd5fcb3",
    "inputFileCount": 4,
    "inputBytes": 6953,
    "npmIntegrityVerified": true,
    "analysisResult": "completed"
  }
}