Sato Check · Package
game_sdk
pypi:game_sdk · v0.1.5 · sha256:838c204833fa · as of 2026-09-29
- Does it take your key? traced
- Yes — it reads private-key material. Local signing is what a wallet does; question 2 says whether the key leaves.
- Our static read of the published artifact found it.
- Does your key leave? no evidence
- Not yet run — we have not run this version with planted test keys.
- No evidence line on file for this question yet.
- Can it move funds on its own? no evidence
- Unknown — we could not read what it exposes.
- No evidence line on file for this question yet.
- What changed? no evidence
- First profile of this subject — nothing to compare yet.
- No evidence line on file for this question yet.
Is this your project? Respond →Dispute this reading
Hosts contacted
| Host | When | Role | Evidence |
|---|---|---|---|
| api.allora.network | code | other | traced |
| api.neynar.com | code | other | traced |
| api.telegram.org | code | other | traced |
| api.together.xyz | code | other | traced |
| api.virtuals.io | code | vendor | traced |
| discord.com | code | other | traced |
| evm.confluxrpc.com | code | other | traced |
| game-api.virtuals.io | code | vendor | traced |
| game.virtuals.io | code | vendor | traced |
| sdk.game.virtuals.io | code | vendor | traced |
| state.gmika.io | code | other | traced |
| subnet-api.bitmind.ai | code | other | traced |
| subnet-api.bitmindlabs.ai | code | other | traced |
| twitter.game.virtuals.io | code | vendor | traced |
Evidence (15 lines)
- tracedT-key-read2026-09-29
Reads os.environ CDP_API_KEY_PRIVATE_KEY.
plugins/cdp/cdp_game_sdk/cdp_plugin.py:17
- tracedT-hosts2026-09-29
api.allora.network appears in shipped code (other).
plugins/allora/allora_game_sdk/allora_plugin.py
- tracedT-hosts2026-09-29
api.neynar.com appears in shipped code (other).
src/game_sdk/hosted_game/functions/farcaster.py
- tracedT-hosts2026-09-29
api.telegram.org appears in shipped code (other).
src/game_sdk/hosted_game/functions/telegram.py
- tracedT-hosts2026-09-29
api.together.xyz appears in shipped code (other).
plugins/imagegen/imagegen_game_sdk/imagegen_plugin.py
- tracedT-hosts2026-09-29
api.virtuals.io appears in shipped code (vendor).
src/game_sdk/game/api.py
- tracedT-hosts2026-09-29
discord.com appears in shipped code (other).
src/game_sdk/hosted_game/functions/discord.py
- tracedT-hosts2026-09-29
evm.confluxrpc.com appears in shipped code (other).
plugins/conflux/conflux_plugin_gamesdk/conflux_plugin_gamesdk.py
- tracedT-hosts2026-09-29
game-api.virtuals.io appears in shipped code (vendor).
src/game_sdk/hosted_game/sdk.py
- tracedT-hosts2026-09-29
game.virtuals.io appears in shipped code (vendor).
src/game_sdk/game/api.py
- tracedT-hosts2026-09-29
sdk.game.virtuals.io appears in shipped code (vendor).
src/game_sdk/game/api_v2.py
- tracedT-hosts2026-09-29
state.gmika.io appears in shipped code (other).
plugins/stateofmika/stateofmika_plugin_gamesdk/functions/router.py
- tracedT-hosts2026-09-29
subnet-api.bitmind.ai appears in shipped code (other).
plugins/bittensor/bittensor_game_sdk/bittensor_plugin.py
- tracedT-hosts2026-09-29
subnet-api.bitmindlabs.ai appears in shipped code (other).
plugins/bittensor/bittensor_game_sdk/bittensor_plugin.py
- tracedT-hosts2026-09-29
twitter.game.virtuals.io appears in shipped code (vendor).
plugins/twitter/twitter_plugin_gamesdk/game_twitter_auth.py
Limits
- The observed lane has not run on this version: not yet run on this version
- Traced analysis follows flows inside one module only; a key handed from one module to another is not followed.
- The observed lane has not run on this version.
- No tool inventory was available, so fund actions were not read.
- Traced: Python read line by line, not parsed.
A profile describes what we read and ran, with dates. It is not a safety rating, an audit or an endorsement, and "not found" is not "not there".
sato.custody/v1 · custody-1
Maintain this project? Respond to this reading
Loading sign-in…