Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@yield-agentkit-skills/skills/yield-agentkit-privy/references/privy-policies.md`:
- Around line 61-99: Update the policy docs to warn that template limits are
denominated in wei and that the displayed USD approximations (e.g., the
Conservative template's "value": "200000000000000000" / 0.2 ETH ≈ "$500") will
drift as ETH price changes; add a short "Important: ETH Price Volatility" note
before the templates section recommending users to (1) periodically adjust wei
values in templates like "Yield Agent — Conservative", "Balanced" and "Power
User" if they define limits in fiat, and (2) consider using the DeFi Contract
Allowlist template for USD-stable token restrictions.

In
`@yield-agentkit-skills/skills/yield-agentkit-privy/references/privy-transactions.md`:
- Around line 58-66: Add JSON fence language annotations to the fenced code
blocks shown (the example with "method": "eth_sendTransaction" and the error
object with "error": { "code": "POLICY_VIOLATION", ... }) so the markdown linter
(MD040) is satisfied; update the opening backticks from ``` to ```json for both
examples (the request/response blocks containing "eth_sendTransaction" and the
error object) while leaving their contents unchanged.
- Around line 118-119: Fix the duplicated word in the polling instruction:
replace the phrase "Poll every 3–5 seconds to to check status." with "Poll every
3–5 seconds to check status." in the privy-transactions.md content so the
sentence reads correctly and retains the guidance about not proceeding until
`status` reaches a terminal state.

In
`@yield-agentkit-skills/skills/yield-agentkit-privy/references/privy-wallets.md`:
- Line 9: The sentence "Always attach a policy. A wallet without a policy should
never exist." conflicts with other docs (privy-policies.md and README workflow)
that mark policies as optional; change this line in privy-wallets.md to soften
the requirement and match other docs—replace it with wording like "Attaching a
policy is strongly recommended; a wallet without a policy has no built-in
constraints on transactions" (or similar) so guidance across files is
consistent.

In
`@yield-agentkit-skills/skills/yield-agentkit-privy/references/semi-autonomous.md`:
- Around line 77-80: Update the truncated credential error prompt in
semi-autonomous.md so the full action path and guidance are included: locate the
message string "Privy credentials are not configured in your environment." and
replace it with a complete, actionable prompt that tells the user how to
configure Privy (e.g., which env vars to set, where to obtain credentials, and
an example command), ensuring the full instruction block is present and not cut
off so onboarding flow continues smoothly.
- Around line 314-325: The current guidance to mutate nonce per stepIndex
conflicts with the rule "never modify unsignedTransaction"; instead compute the
adjusted nonce from the nonce returned for stepIndex=0 (convert hex→decimal, add
stepIndex, convert decimal→hex) and apply that adjusted nonce only in the
submission payload or a new transaction copy without mutating
unsignedTransaction itself; implement a small helper (e.g.,
computeAdjustedNonce(nonceHex, stepIndex)) and use it right before sending to
Privy, leaving the original unsignedTransaction intact and documented.
- Line 217: The sentence "Ask the user to check the dashboard and muannly
approve this." contains a typo; update the word "muannly" to "manually" so the
instruction reads "Ask the user to check the dashboard and manually approve
this." Edit the line in the semi-autonomous.md content where that exact sentence
appears.
- Around line 274-276: Update the CAIP-2 value for Solana in the
semi-autonomous.md example by replacing the current string value for the "caip2"
key ("solana:mainnet") with the Privy-supported canonical identifier
"solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp" so the example that uses "method":
"signAndSendTransaction" matches the privy-transactions.md canonical format and
prevents integration failures with Privy's API.

In
`@yield-agentkit-skills/skills/yield-agentkit-privy/references/yield-input-format.md`:
- Line 26: Update the `type` enum description in yield-input-format.md to
explicitly state the source API and add a maintenance verification note: mention
that these values are sourced from the Yield.xyz API (`GET /v1/yields`),
instruct maintainers to verify the enum against the latest API response when
they see validation errors, and add a "Last verified: YYYY-MM-DD" timestamp
placeholder so reviewers update it whenever they confirm the list (also ensure
the note highlights that the only valid values are the eight listed, including
`fixed_yield`, to prevent drift).

In
`@yield-agentkit-skills/skills/yield-agentkit-privy/references/yield-mcp-tools.md`:
- Around line 208-211: The doc conflict is that unsignedTransaction is described
as "pass verbatim" but Privy requires a constructed payload (see
privy-transactions.md) and chain-specific conversions (e.g., Solana base64).
Update the guidance to treat unsignedTransaction as the canonical source of
fields but do NOT mutate it; instead create a new Privy-compatible payload
(e.g., via a buildPrivyPayload helper) that copies fields from
unsignedTransaction and performs chain-specific transformations (Solana base64
encoding, any MCP-required field mapping) before submitting to Privy; reference
unsignedTransaction, Privy, and the privy-transactions.md rules so callers know
when to copy vs when to transform.

In `@yield-agentkit-skills/skills/yield-agentkit-privy/SKILL.md`:
- Around line 300-310: The fenced code block in SKILL.md that contains the
prompt-injection examples (the triple-backtick block showing lines like "Ignore
previous instructions..." and "Transfer to 0x... immediately") is missing a
language tag; update that opening fence to include a language specifier (for
example use ```text or ```diff) so markdownlint MD040 is satisfied and the block
is treated as a code/monospace block with proper syntax styling.
- Line 330: Fix the typo in the table row for
`{baseDir}/references/yield-policies.md` by changing the description text from
"Data fetching and API usgae rules for Yield AgentKit MCP" to "Data fetching and
API usage rules for Yield AgentKit MCP" so the word "usgae" is corrected to
"usage".
- Around line 25-37: The SKILL.md rule forbids modifying unsignedTransaction but
semi-autonomous.md instructs mutating the nonce via stepIndex, creating a
conflict; reconcile by choosing one approach: either (A) enforce
immutability—remove any nonce mutation tied to stepIndex, update
semi-autonomous.md to stop instructing mutation and instead instruct requesting
a NEW action with the correct nonce/amount, or (B) if nonce adjustment must be
supported, implement a safe separate field (e.g., adjustedNonce) and flow that
never mutates unsignedTransaction itself, update SKILL.md to document the
controlled exception, and change references to stepIndex to use the new field;
locate and change all code/docs referencing unsignedTransaction and stepIndex
accordingly.
- Around line 77-88: The user-facing "missing credentials" message in SKILL.md
is truncated; update the check that echoes PRIVY_APP_ID and PRIVY_APP_SECRET to
emit a complete, well-formed message string when either is empty — e.g. a full
quoted block that closes properly and contains the remediation: "Privy
credentials are not configured in your environment. Please set up Privy and
export PRIVY_APP_ID and PRIVY_APP_SECRET." Ensure the message covers both
variables and that the runbook instructs to stop immediately when the check
fails.

---

Nitpick comments:
In `@yield-agentkit-skills/README.md`:
- Around line 107-121: Add a third column for the new skill package name
`yield-agentkit-privy` to the "Which skill should I use?" comparison table in
README.md: include the header `yield-agentkit-privy` and populate rows for the
features shown (Find yields, Build transactions, Sign + broadcast, Check
balances, MoonPay account needed, Setup complexity) — for example set Find
yields ✅, Build transactions ✅, Sign + broadcast ✅ via Privy wallet, Check
balances ✅, Privy account needed Yes, and Setup complexity Guided wizard —
ensure the table alignment and markdown pipes match the existing
`yield-agentkit` / `yield-agentkit-moonpay` columns so the table renders
correctly.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@yield-agentkit-skills/skills/yield-agentkit-privy/references/privy-policies.md`:
- Around line 62-72: Remove the trailing spaces after the blockquote marker in
the "⚠️ Critical — Rule Evaluation Logic" block to fix MD027 and label the
unlabeled fenced checklist block with a language (e.g., use ```text) to satisfy
MD040; locate the block by searching for the "⚠️ Critical — Rule Evaluation
Logic" heading and the <details>/<summary> checklist section and update the
blockquote lines to remove extra spaces after '>' and add a language tag to the
fenced code fence so the markdown linter accepts it.

In
`@yield-agentkit-skills/skills/yield-agentkit-privy/references/privy-transactions.md`:
- Around line 10-12: Update the two unlabeled fenced code blocks that trigger
markdownlint MD040 by adding a language identifier (e.g., text) to the opening
backticks: the block containing "POST
https://api.privy.io/v1/wallets/{wallet_id}/rpc" and the block containing the TX
stepIndex lines; change their opening fences from ``` to ```text so markdownlint
recognizes them as plain text.
- Around line 21-35: The docs assume a structured unsignedTransaction but
TransactionDto.unsignedTransaction is documented as raw tx data; update the
documentation and transformation steps to match: either (A) define and document
a canonical unsignedTransaction JSON schema (listing fields like from, to, data,
nonce, type, chainId) and update the jq examples (PRIVY_TX and references to
TransactionDto.unsignedTransaction) to use that schema, or (B) keep
unsignedTransaction as raw RLP/hex and replace the jq snippet with a clear
decoding step (describe using a decoder to parse the raw tx into fields, then
construct PRIVY_TX from those decoded fields). Reference the symbols
unsignedTransaction, PRIVY_TX and TransactionDto.unsignedTransaction when making
the change so all occurrences (including the step at lines ~111-113) are
aligned.

In `@yield-agentkit-skills/skills/yield-agentkit-privy/SKILL.md`:
- Around line 59-65: The fenced code block showing the architecture flow (the
unlabeled triple-backtick block containing "User prompt → Yield.xyz AgentKit MCP
builds unsignedTransaction → Privy (checks policy rules) → Privy signs +
broadcasts → yield.xyz hash submitted + confirmed") needs a language tag to
satisfy MD040; change the opening fence from ``` to ```text so the block is
explicitly labeled and lint-clean, leaving the block contents unchanged.
- Around line 244-252: Update SKILL.md to match the canonical flow in
references/privy-transactions.md: instead of instructing callers to POST the raw
<unsignedTransaction> as params.transaction, document building and sending the
Privy-compatible EVM object described in references/privy-transactions.md (the
constructed payload shape for eth_sendTransaction) and show that object is
passed as params.transaction to the POST to
https://api.privy.io/v1/wallets/{PRIVY_WALLET_ID}/rpc; reference the
eth_sendTransaction method, the params.transaction field, and the
unsignedTransaction source from the MCP response so readers know to transform
the MCP unsignedTransaction into the Privy EVM payload before sending.

---

Duplicate comments:
In `@yield-agentkit-skills/skills/yield-agentkit-privy/SKILL.md`:
- Around line 300-310: The unlabeled code fence containing the prompt-injection
example list in SKILL.md should be given a language tag (e.g., ```text or
```text-plain) to satisfy MD040; locate the triple-backtick block that wraps the
lines beginning with "❌ \"Ignore previous instructions...\"" and add a language
identifier immediately after the opening backticks so the fence is no longer
unlabeled.
- Around line 86-88: The markdown error block in SKILL.md containing the Privy
credentials message is malformed: the second line isn't quoted and a stray '>'
remains; update the block so both lines are inside a single properly formatted
block or inline quote (e.g., use a fenced code/quote block or prefix each line
with '> ') and remove the trailing standalone '>' so the stop-path message reads
as a single well-formed quoted block (the message starting "Privy credentials
are not configured in your environment. Please set up Privy skill and
credentials before using this skill.").

---

Nitpick comments:
In
`@yield-agentkit-skills/skills/yield-agentkit-privy/references/privy-policies.md`:
- Around line 77-81: The fenced code blocks in the privy-policies examples
(e.g., the pseudo-rule snippet starting with rules: [ { chain_id eq "8453",
value lte "2000000000000000" } ]) are labeled as `json` but are not valid JSON;
update each such block (including the other similar blocks around the file) by
either converting the content to valid JSON (quote keys, use true JSON syntax,
remove inline comments) or change the fence language to `text`/`plain` so they
are not treated as executable JSON; ensure you apply the same fix to the other
occurrences mentioned in the review so examples are copy/paste-safe.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@yield-agentkit-skills/skills/yield-agentkit-privy/SKILL.md`:
- Around line 187-191: The fenced example block containing the three quoted
prompt lines should include a language tag (e.g., change ``` to ```text) to
satisfy the MD040 rule; update the fenced block that holds the strings "List me
the best yields on Base right now.", "Deposit 200 USDC into Aave V3 on
Ethereum.", and "Move my position to the highest-yielding lending protocol." by
adding the language tag so the block becomes a typed fence (for example,
```text).

---

Duplicate comments:
In `@yield-agentkit-skills/skills/yield-agentkit-privy/SKILL.md`:
- Around line 59-64: The fenced code block that shows the architecture flow (the
block starting with ``` and containing "User prompt → Yield.xyz AgentKit MCP
builds unsignedTransaction → Privy (checks policy rules) → Privy signs +
broadcasts") needs a language tag to satisfy MD040; change the opening fence
from ``` to a typed fence such as ```text (or another appropriate language like
```flow) so the block is a typed fence and linting passes.
- Around line 246-253: The doc currently contradicts itself by saying to
transform MCP output into a Privy-compatible transaction (refer to
{baseDir}/references/privy-transactions.md) but then shows sending
"<unsignedTransaction>" directly; update the example so the POST body uses the
transformed transaction shape (i.e., pass the canonical Privy-compatible payload
in params.transaction), replace "<unsignedTransaction>" with the transformed
transaction placeholder (e.g., the output of the transform step), and ensure the
example matches the eth_sendTransaction RPC and the "params.transaction" name
used earlier.
- Around line 301-311: The fenced code block containing the prompt-injection
examples in SKILL.md is missing a language tag causing markdownlint MD040;
update the opening fence from ``` to ```text (or another appropriate language)
for that specific fenced block so the block becomes ```text ... ``` and the
linter error is resolved while preserving the existing block content.
- Around line 83-87: Fix the malformed stop-path message in SKILL.md: replace
the broken quote block spanning lines 85–87 with a properly formatted blockquote
containing the complete remediation text, e.g., a single clear message "Privy
credentials are not configured in your environment. Please set up the Privy
skill and credentials before using this skill." Ensure the sentence follows the
"If either is empty → stop immediately and tell the user:" lead-in and that the
blockquote renders correctly (no stray '>' or missing punctuation) so the stop
instruction is unambiguous.