Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ccashwell/evm-cortex --skill erc8004-patternsgit clone --depth 1 https://github.com/ccashwell/evm-cortexWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ccashwell/evm-cortex/erc8004-patterns)<a href="https://agentmods.dev/skills/ccashwell/evm-cortex/erc8004-patterns"><img src="https://agentmods.dev/badge/skills/ccashwell/evm-cortex/erc8004-patterns/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ccashwell/evm-cortex/erc8004-patterns"><img src="https://agentmods.dev/badge/skills/ccashwell/evm-cortex/erc8004-patterns.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.01812 |
| Opus 5.5 | $0.00020 | $0.00725 |
| Sonnet 5.5 | $0.00010 | $0.00362 |
| Haiku 4.5 | $0.00005 | $0.00181 |
Grade A, and why
erc8004-patterns scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 17d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 233 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ERC-8004 Onchain Agent Identity
Overview
ERC-8004 establishes a standard for AI agent identity onchain. Deployed on January 29, 2026 across 20+ chains, it provides a registry for agents to declare their identity, capabilities, and trust relationships. This enables verifiable agent-to-agent and agent-to-protocol interactions.
Core Interface
interface IERC8004 {
struct AgentIdentity {
address agent; // agent's onchain address (EOA or contract)
bytes32 identityHash; // hash of offchain identity metadata
uint64 registeredAt;
uint64 expiresAt;
address operator; // human or org that controls the agent
uint8 trustLevel; // 0-255 trust score
}
struct Capability {
bytes32 capabilityId; // keccak256 of capability name
bytes params; // ABI-encoded capability parameters
}
event AgentRegistered(address indexed agent, bytes32 identityHash, address indexed operator);
event AgentRevoked(address indexed agent, address indexed revokedBy);
event CapabilityDeclared(address indexed agent, bytes32 indexed capabilityId);
function registerAgent(AgentIdentity calldata identity, Capability[] calldata capabilities) external;
function revokeAgent(address agent) external;
function getIdentity(address agent) external view returns (AgentIdentity memory);
function getCapabilities(address agent) external view returns (Capability[] memory);
function isRegistered(address agent) external view returns (bool);
function hasCapability(address agent, bytes32 capabilityId) external view returns (bool);
function verifyAgent(address agent, bytes32 requiredCapability) external view returns (bool);
}
Registry Integration
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;
import {IERC8004} from "./interfaces/IERC8004.sol";
contract AgentGatedProtocol {
IERC8004 public immutable agentRegistry;
bytes32 public constant TRADE_CAPABILITY = keccak256("trade");
bytes32 public constant REBALANCE_CAPABILITY = keccak256("rebalance");
modifier onlyRegisteredAgent() {
require(agentRegistry.isRegistered(msg.sender), "Not a registered agent");
_;
}
modifier requiresCapability(bytes32 capId) {
require(agentRegistry.verifyAgent(msg.sender, capId), "Missing capability");
_;
}
constructor(address registry_) {
agentRegistry = IERC8004(registry_);
}
function executeTrade(bytes calldata tradeData)
external
onlyRegisteredAgent
requiresCapability(TRADE_CAPABILITY)
{
// Agent-executed trade logic
}
function rebalanceVault()
external
onlyRegisteredAgent
requiresCapability(REBALANCE_CAPABILITY)
{
// Only agents with rebalance capability
}
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 17d ago Changed · +5 lines 0c272defb41d
- 1mo ago First seen · 228 lines · 49 tokens per session scan A 9a2a0b8fb245
erc8004-patterns is a skill published in the GitHub repository ccashwell/evm-cortex (131 stars, last pushed 17d ago), licensed MIT. It adds 49 tokens to every session and 1,812 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
signature-replay
Signature replay attacks — missing nonces, missing chain ID, ecrecover zero address, signature malleability, cross-chain replay.
official-sui-skills
Pointer to the official Mysten Labs skills for building on Sui — language fundamentals, object model, PTBs, SDKs, publishing, upgrades, frontend integration, accessing on-chain data. Maintained upstream at github.com/MystenLabs/skills; pinned to the same ref the audit catalog derives from (see…
bridge
Cross-chain token transfers using Wormhole and CCTP.
onchainkit
Build onchain apps with Coinbase's OnchainKit React components - wallets, swaps, NFTs, payments.
marginfi
MarginFi — Solana lending and borrowing.
devtools-event-client
Create typed EventClient for a library. Define event maps with typed payloads, pluginId auto-prepend namespacing, emit()/on()/onAll()/onAllPluginEvents() API. Connection lifecycle (5 retries, 300ms), event queuing, enabled/disabled state, SSR fallbacks, singleton pattern. Unique pluginId requirement to avoid event…