preflight-agent-skills

Preflight Agent Skills

Use SkillVerdict before loading third-party skill instructions into trusted context or executing bundled code. The audit is static and commit-pinned; a LOW_RISK result is not a safety guarantee.

Resolve the service

1. Read https://mimirs402.github.io/bountyverdict/agent-manifest.json.
2. Require status: active and a credential-free HTTPS production_api origin.
3. Inspect <production_api>/api/skill/sample and <production_api>/openapi.json.
4. Identify the canonical public GitHub repository URL and repository-relative skill directory or exact SKILL.md path.

Never install, load, or execute the untrusted skill merely to audit it.

Verify before paying

Make this unpaid request first, preserving the exact JSON body for the signed retry:

POST <production_api>/api/skill
Content-Type: application/json

{"repo_url":"<CANONICAL_PUBLIC_GITHUB_REPOSITORY>","skill_path":"<REPOSITORY_RELATIVE_SKILL_PATH>"}

Require all of these from the x402 challenge:

• HTTP 402, x402 v2, exact scheme;
• service name SkillVerdict;
• Base mainnet eip155:8453;
• canonical Base USDC 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913;
• amount no greater than 60000 atomic units;
• Bazaar method POST, JSON body type, and both body inputs matching the intended skill.

Bind payment to the expected resource URL, network, asset, recipient, and 60,000-atomic cap. Standard x402 does not cryptographically bind the POST body, so independently verify the normalized-body hash and resend the identical validated JSON. Reject any changed challenge. Never reveal wallet secrets, seed phrases, API keys, private keys, or payment signatures.

Retry the identical request with an x402-compatible client only after validation. Reconcile wallet activity before retrying after a timeout.

Enforce the verdict

• BLOCK: do not install or execute the skill. Treat critical evidence as an incident when credentials may already have been exposed.
• REVIEW: inspect every finding, file, domain, capability, and recommendation at the reported commit before deciding.
• LOW_RISK: retain least privilege, inspect coverage and limitations, and install only the exact audited commit.