EndaomentSAFE
Bankr Skills equip builders with plug-and-play tools to build more powerful agents.
Overview
Bankr Skills equip builders with plug-and-play tools to build more powerful agents.
4029e336cef5OBSERVED · 2026-10-09What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
--- name: endaoment description: Donate to charities onchain via Endaoment. Use when the user wants to donate crypto to charity, make a charitable contribution, give to nonprofits, support a cause, or donate to a 501(c)(3). Supports Base, Ethereum, and Optimism. Handles USDC donations directly or swaps ETH/tokens to USDC automatically. --- # Endaoment Charity Donations Donate to 501(c)(3) nonprofits onchain via Endaoment's smart contracts. ## Quick Start ### Find a Charity Search by name or EIN: ```bash ./scripts/search.sh "27-1661997" # EIN lookup (GiveDirectly) ./scripts/search.sh "Red Cross" # Name search ``` ### Donate USDC (Base) ```bash ./scripts/donate.sh <ein> <amount_usdc> ``` Example: Donate $5 USDC to GiveDirectly: ```bash ./scripts/donate.sh 27-1661997 5 ``` ## How It Works The donate script uses Bankr's arbitrary transaction feature to: 1. Approve USDC to the Endaoment OrgFundFactory 2. Call `deployOrgAndDonate(orgId, amount)` which: - Deploys the charity's entity contract on Base (if not already deployed) - Donates the specified USDC amount ## Popular Charities | Charity | EIN | |---------|-----| | GiveDirectly | 27-1661997 | | North Shore Animal League America | 11-1666852 | | American Red Cross | 53-0196605 | | Doctors Without Borders | 13-3433452 | | ASPCA | 13-1623829 | See `references/popular-charities.md` for more. ## Contract Addresses (Base) | Contract | Address | |----------|---------| | Registry | `0x237b53bcfbd3a114b549dfec96a9856808f45c94` | | OrgFundFactory | `0x10fd9348136dcea154f752fe0b6db45fc298a589` | | USDC | `0x833589fcd6edb6e08f4c7c32d4f71b54bda02913` | ## Fees - **Org donations**: 1.5% fee (e.g., $100 → $1.50 fee, $98.50 to charity) - **Fund donations**: 0.05-0.50% tiered ## Requirements - Bankr skill with API key configured - USDC balance on Base - ETH on Base for gas (Bankr covers this) ## Technical Details ### Function Selectors - `approve(address,uint256)`: `0x095ea7b3` - `deployOrgAndDonate(bytes32,uint256)`: `0xdb9e30cc` ### OrgId Encoding The EIN (e.g., "11-1666852") is encoded as bytes32: ``` "11-1666852" → 0x31312d3136363638353200000000000000000000000000000000000000000000 ``` ## Notes - All donations are tax-deductible (US 501(c)(3) orgs) - Donations are permissionless — anyone can donate - Uses Bankr arbitrary transactions for contract interaction - Works on Base; other chains require different addresses
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (4 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (0)
No findings outside the package's declared scope.
Gates applied: no_behavioural_pass.
4029e336cef5full audit observations/trust-audit/skill/bankrbot__endaoment.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-09 | 4029e336cef5 | SAFE | B | 89 | first audit |
Questions
What does the Endaoment skill do?
Bankr Skills equip builders with plug-and-play tools to build more powerful agents.
Is Endaoment safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can Endaoment access on my machine?
The audit observed that it reaches the network. Each of those is consistent with what it says it does. Secrets in the source: none found.
How current is this page?
The grade is for one exact copy of the source (4029e336cef5), read on 2026-10-09. The repository is watched, and a new audit runs when it changes — this is the first audit.