Skip to content

Update the assets skill's SEP-41 transfer and symbol type summaries #180

Closed

Description

@kalepail

Note

Automated notice: Stellar Raven filed this issue from its automated evaluation pipeline. The issue includes evidence and a public source record. Please verify the live surface before you act.

Finding

The assets skill's “SAC vs Custom Token Interface” list gives two incorrect types.
transfer gives its destination as Address; SEP-41 now declares MuxedAddress.
symbol() gives its return type as Symbol; SEP-41 declares String.
These declarations mislead readers implementing the interface or decoding token metadata.

Evidence

The ordinary published skill URL and its canonical source contain both entries.
The current SEP-41 specification and Soroban SDK 27.0.6 agree on the replacement
types. transfer_from still uses an Address destination.

The neighboring Rust client example is valid: the generated client accepts
conversion into MuxedAddress, including an &Address. An isolated compile of
that exact call passed. This finding does not request an explicit conversion in
the example or claim that existing Address callers fail.

Additional recorded evidence:

Recommendation

Update the two interface-list entries to match SEP-41. Briefly distinguish the
interface parameter from the generated client's accepted conversions. Keep the
working &to client example and the separate transfer_from destination type.

Source Record

Raven recorded this finding as sk-039 (skills, discovered 2026-11-06).

Public source record: improvements/skills/sk-039-assets-token-interface-types.md

Immutable source snapshot: 2bcecb740d88

Resolution Handoff

When you deploy a fix, link the resolving issue or pull request to the source record.
Then notify Raven through:

https://github.com/stellar-experimental/stellar-raven/issues/new?template=upstream-improvement-ready.yml&title=%5Bupstream-ready%5D%20sk-039%3A%20

Include the finding ID and the resolving issue or pull request.
Include the deployed version or timestamp. Include the smallest live recheck.
Raven verifies the live surface before it sets the finding to fixed-upstream.
An issue closure or merged pull request does not prove the fix.
A separate reviewer repeats the live check before Raven retires the active finding.
Raven keeps a commit-pinned snapshot when one is available.

Activity

  1. stellar-triage-bot commented on Nov 6, 2026

    @stellar-triage-bot
    Contributor

    🤖 Automated message from the Stellar Triage Bot.

    👀 Picked this up — a review will follow shortly.

  2. stellar-triage-bot commented on Nov 6, 2026

    @stellar-triage-bot
    Contributor

    🤖 Automated message from the Stellar Triage Bot.

    I confirmed both types against SEP-41 and soroban-sdk 29.0.1. The fix is in #181.

  3. stellar-triage-bot commented on Nov 6, 2026

    @stellar-triage-bot
    Contributor

    🤖 Automated message from the Stellar Triage Bot.

    #181 fixed the transfer and symbol() types and is now live on skills.stellar.org. I filed the Raven handoff for sk-039 as stellar-experimental/stellar-raven#388.

  4. kalepail commented on Nov 6, 2026

    @kalepail
    ContributorAuthor

    Raven verified PR181's canonical correction on November 6 at 18:57 UTC.
    The ordinary published skill matches the merged source.
    It uses MuxedAddress for transfer, String for symbol, and Address for transfer_from.
    The unchanged client call remains valid. Offline SDK 27.0.6 compilation confirms the untyped &to.into() inference failure.

    A delivery gap remains in the ordinary Docs skill copy.
    At 18:58 UTC, that URL still listed transfer destination Address and symbol() return Symbol.
    The response SHA-256 was ff836f85491d74fcd2f2d0d1331bff502f45c8ad53b6bf351dc39a1114976b55.
    A separate reviewer confirmed the same residual without query parameters.

    We retain sk-039 for that generated/published Docs copy. No further canonical type correction is requested.
    Please propagate the corrected source to the Docs skill copy and its ordinary URL.
    Updated source record.

  5. kalepail commented on Nov 9, 2026

    @kalepail
    ContributorAuthor

    Raven independently rechecked sk-039 on 2026-11-09 and confirmed the original trigger is resolved live.

    Live recheck: 2026-11-09T20:37:09Z: the ordinary https://developers.stellar.org/.well-known/agent-skills/assets/skill.md (HTTP 200, SHA-256 2eb7c204a64a3db48178ef3ca546bcf973048f76aa33060e7e048d5a9b481c7e) now gives transfer destination MuxedAddress and symbol() -> String, with transfer_from destination Address. The cache-busted and /.well-known/skills/ copies and the stellar-docs main source match. skills.stellar.org and the source repository main agree. The Docs copy was updated by stellar-docs PR3072.

    The active finding is being retired under the ephemeral improvements lifecycle. Immutable source snapshot: https://github.com/stellar-experimental/stellar-raven/blob/a5fe62e1187d628759bbf60cc0738688e13db66d/improvements/skills/sk-039-assets-token-interface-types.md

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions