Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add HinkoK/agent-skills --skill online-store-legitimacy-checksgit clone --depth 1 https://github.com/HinkoK/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hinkok/agent-skills/online-store-legitimacy-checks)<a href="https://agentmods.dev/skills/hinkok/agent-skills/online-store-legitimacy-checks"><img src="https://agentmods.dev/badge/skills/hinkok/agent-skills/online-store-legitimacy-checks/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hinkok/agent-skills/online-store-legitimacy-checks"><img src="https://agentmods.dev/badge/skills/hinkok/agent-skills/online-store-legitimacy-checks.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.01032 |
| Opus 5 | $0.00031 | $0.00516 |
| Sonnet 5 | $0.00012 | $0.00206 |
| Haiku 4.5 | $0.00006 | $0.00103 |
Grade A, and why
online-store-legitimacy-checks scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Online store legitimacy checks
Use this skill when the user asks whether an unfamiliar webshop, checkout page, product listing, or ecommerce domain is trustworthy enough to buy from.
Hermes usage rules
- Start with a clear verdict: likely OK, mixed / caution, or avoid.
- Use web evidence when available; do not infer legitimacy from HTTPS alone.
- Never ask the user to enter card details, credentials, or checkout information for verification.
- Prefer official registries, company identity, terms, payment protections, reputation patterns, and price plausibility.
- When evidence is incomplete, say what was not verifiable and give a safe buying path.
Default answer shape
- Give a clear verdict first: likely OK / mixed / avoid.
- Then list specific evidence checked.
- End with practical safe-buying advice: payment method, URL hygiene, return/delivery caveats.
- Avoid overclaiming: say “looks legitimate” rather than “guaranteed safe”.
Evidence workflow
Check as many of these as are available without logging in or entering sensitive data:
-
URL and domain sanity
- Confirm the domain is the expected store domain, not a lookalike or tracking redirect.
- Prefer the store homepage and navigate from there when the user sends a deep checkout URL.
- Old CGI/cart paths can be legitimate if they remain under the correct domain.
-
Transport/security basics
- Check HTTPS and whether the certificate matches the domain or parent brand.
- Treat valid HTTPS as necessary but not sufficient.
-
Company identity
- Find legal entity name, VAT/CVR/org number, physical address, email, and phone in terms/contact pages.
- Cross-check the legal name/VAT/domain through search snippets or official/company registries when possible.
-
Commerce terms
- Look for purchase terms, delivery page, returns/cancellation policy, warranty/complaints process, and privacy/cookie pages.
- For EU/cross-border shops, note if the company ships from another country and whether returns may be inconvenient.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 107 lines · 62 tokens per session scan A 98eb7f9ee865
online-store-legitimacy-checks is a skill published in the GitHub repository HinkoK/agent-skills (5 stars, last pushed 3mo ago), licensed MIT. It adds 62 tokens to every session and 1,032 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ckjia-shopping
A shopping search and price-comparison tool for Taobao, JD.com, Tmall, and Pinduoduo, with image-based product recognition. It requires the ckjia-shopping service and its access key to be enabled.
moonpay-commerce
Browse Shopify stores, search products, manage a cart, and checkout with crypto via Solana Pay. No login required.
open-supermarkets
Grocery automation across nine retailers in five countries — UK, Netherlands, Belgium, Spain and the US. Search, compare, basket, delivery slots and checkout, plus Open Food Facts nutrition and allergen enrichment. Available as CLI, MCP server, or agent skill.
grocery-api
Use the local groc HTTP API to search Sainsbury's groceries, search favourites, add/update/remove basket items, and view basket.
marketplace-purchase-vetting
Use this when the user asks whether a local listing is a scam, "too good to be true," worth looking at, or a good deal. Also use this when he asks you to find options — search/discover candidates, then vet the best ones. The goal is not a generic buying guide; it is a practical risk read with clear next steps.
d1-cli
Shop Tiendas D1 (Colombia, d1.com.co) from the command line — search the catalogue, resolve your nearest physical store, price a basket against that store's real stock, and quote delivery. D1 runs VTEX IO (account d1tiendas), so this drives its public storefront API with no admin key at all — catalogue and cart work…