What is authoring-specs?

Guidelines for writing x402 specification files. x402 is a protocol for describing payment-related exchanges, and the guide covers formats, version 2 fields, networks, units, and normative wording.

Use it when creating or proposing an x402 scheme or extension specification in Markdown.

It prevents new specifications from using the wrong protocol version, field names, network notation, or document conventions.

How coinbase/x402 configures Claude Code and Codex

Reuse

Borrowing it

Nothing to install: this file belongs to coinbase/x402. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/coinbase/x402/main/.agents/skills/authoring-specs/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/coinbase/x402

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/coinbase/x402/authoring-specs/github.svg)](https://agentmods.dev/skills/coinbase/x402/authoring-specs)

Your own site

<a href="https://agentmods.dev/skills/coinbase/x402/authoring-specs"><img src="https://agentmods.dev/badge/skills/coinbase/x402/authoring-specs/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/coinbase/x402/authoring-specs"><img src="https://agentmods.dev/badge/skills/coinbase/x402/authoring-specs.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 43 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 455 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin fork From a forked repository.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00043	$0.00455
Opus 5.5	$0.00017	$0.00182
Sonnet 5.5	$0.00009	$0.00091
Haiku 4.5	$0.00004	$0.00046

Measured 2d ago against content hash 4650bc0fce65, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

authoring-specs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/authoring-specs/SKILL.md · 35 lines

What it actually says

Authoring x402 specs

Guidance for writing x402 specification files under specs/. Use RFC-2119 keywords for normative statements (MUST / MUST NOT, SHOULD / SHOULD NOT, MAY).

General rules

These apply to every spec type (scheme, extension). The references below add type-specific detail.

Naming

Name schemes and extensions in lowercase, hyphen-separated kebab-case (e.g. batch-settlement, offer-receipt), never camelCase.

Protocol version, networks, and units

Target protocol v2 only: x402Version: 2, the amount field (not v1's maxAmount), and the PAYMENT-REQUIRED / PAYMENT-SIGNATURE / PAYMENT-RESPONSE headers (not v1's X-PAYMENT / X-PAYMENT-RESPONSE). See the v1 to v2 migration guide.
Use canonical CAIP-2 network notation (e.g. eip155:84532, not base-sepolia).
Use atomic units for all amounts.

Wire format

Be transport agnostic: specify message contents, not how a particular transport carries them.
Reference core types (PaymentRequirements, PaymentPayload, SettlementResponse) from x402-specification-v2.md.
Every field a spec defines on the wire must be consumed by a downstream role. Do not include human-readable or otherwise purely informational fields.
Reuse field names, patterns, and conventions established by existing specs instead of coining new ones.

References

New network scheme spec (scheme_<name>_<chain>.md): see references/new-network-scheme-spec.md.
New extension spec: to be added.

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

references/new-network-scheme-spec.md 4.8 KB

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 35 lines · 43 tokens per session scan A 4650bc0fce65

Subscribe to this mod's changes

authoring-specs is a skill published in the GitHub repository coinbase/x402 (168 stars, last pushed 2d ago), licensed Apache-2.0. It adds 43 tokens to every session and 455 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. It comes from a forked repository.

Web3 and blockchain

signature-replay

Signature replay attacks — missing nonces, missing chain ID, ecrecover zero address, signature malleability, cross-chain replay.

PurpleAILAB/Decepticon · 31 tokens

official-sui-skills

Pointer to the official Mysten Labs skills for building on Sui — language fundamentals, object model, PTBs, SDKs, publishing, upgrades, frontend integration, accessing on-chain data. Maintained upstream at github.com/MystenLabs/skills; pinned to the same ref the audit catalog derives from (see…

MystenLabs/sui · 116 tokens

bridge

Cross-chain token transfers using Wormhole and CCTP.

alsk1992/CloddsBot · 13 tokens

onchainkit

Build onchain apps with Coinbase's OnchainKit React components - wallets, swaps, NFTs, payments.

alsk1992/CloddsBot · 24 tokens

marginfi

MarginFi — Solana lending and borrowing.

alsk1992/CloddsBot · 11 tokens

devtools-event-client

Create typed EventClient for a library. Define event maps with typed payloads, pluginId auto-prepend namespacing, emit()/on()/onAll()/onAllPluginEvents() API. Connection lifecycle (5 retries, 300ms), event queuing, enabled/disabled state, SSR fallbacks, singleton pattern. Unique pluginId requirement to avoid event…

TanStack/devtools · 79 tokens

x402: Skill for Claude Code