Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add seancrecord/scvd-general-store-repo --skill claude-codegit clone --depth 1 https://github.com/seancrecord/scvd-general-store-repoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/seancrecord/scvd-general-store-repo/claude-code)<a href="https://agentmods.dev/skills/seancrecord/scvd-general-store-repo/claude-code"><img src="https://agentmods.dev/badge/skills/seancrecord/scvd-general-store-repo/claude-code/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/seancrecord/scvd-general-store-repo/claude-code"><img src="https://agentmods.dev/badge/skills/seancrecord/scvd-general-store-repo/claude-code.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00090 | $0.00808 |
| Opus 5 | $0.00045 | $0.00404 |
| Sonnet 5 | $0.00018 | $0.00162 |
| Haiku 4.5 | $0.00009 | $0.00081 |
Grade A, and why
x402-before-you-pay scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 42 lines — stays where its author put it; the contents beside it link to each section on GitHub.
x402: before you pay
A skill for Claude Code (copy this directory to .claude/skills/x402-before-you-pay/) and, with the frontmatter removed, a Cursor rule (x402-before-you-pay.mdc beside it).
When to use it
- Code is about to call an x402 URL with a payment client (
@x402/fetch,x402-axios, a wallet-backed agent). - A 402 looks wrong, or a payment "never went through" and the operator's logs show a clean 402 followed by silence.
- A signed receipt or offer needs checking without trusting the party that produced it.
The walk, in order
-
Read the door's 402 yourself.
GETthe URL; decode thePAYMENT-REQUIREDheader (base64 JSON). Theaccepts[]entries carrynetwork,asset,payToandamount(atomic units). Those are the terms you would sign. -
One POST to the free dry run.
POST https://scvd.store/api/before-you-pay/v1with{"url": "<the url>"}. The answer says whether a stock x402 client would sign (will_your_client_pay:would_sign/would_throw/cannot_simulate), which accept it would pick (your_client.chosen), and carries the free preflight whole asthe_door(verdict:ready/not_ready/unreachable, every check and advisory named). -
Decide, and name why. The shared logic is
examples/shared/decide.mjs(ordecide.py); run it rather than re-deriving:node -e 'import("./examples/shared/decide.mjs").then(async m => console.log(JSON.stringify((await m.beforeYouPayWalk(process.argv[1], { policy: { allowed_networks: ["eip155:8453"], max_amount_usd: 1 } })).decision, null, 2)))' -- https://door.example/api/paid-answerOr with the CLI, for the door's shape alone:
npx scvd-cli preflight https://door.example/api/paid-answer.
How to read the answer
unreachableis not a defect. Unknown is never a difference; the decision iscannot_tell.not_readynames the failed checks;do_not_pay, and quote them.would_throwmeans your own client refuses on your machine before any signature exists. The operator never learns you tried.do_not_pay, and quotethrows_with.- A
testnet-networkadvisory means a mainnet wallet signing this settles nowhere real.do_not_pay. payis a derivation from those readings plus your policy (allowed networks, allowed recipients, a cap). It is not a score and not proof of delivery:does_not_establishrides on every answer. Say so when you report it.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 42 lines · 90 tokens per session scan A 6c75c43ebf7e
x402-before-you-pay is a skill published in the GitHub repository seancrecord/scvd-general-store-repo (3 stars, last pushed today), licensed MIT. It adds 90 tokens to every session and 808 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
bankr-shopify
Shopify Admin & Storefront GraphQL APIs via curl, with Bankr-native bridges. Manage products, orders, customers, inventory, metafields, webhooks, and bulk ops, then wire merchant data to onchain primitives — store a Bankr-resolvable handle (ENS, Twitter, Farcaster, wallet) on each customer as a metafield, expose…
web-extract
Extract public webpages as structured JSON through SameDayDesk. Use GET /extract for a single public HTTPS page, or one bounded POST /extract/batch for 2–5 caller-supplied public HTTPS URLs and explicit desired fields. A caller may explicitly request a one-item batch. Free discovery reads live schemas and 402 terms…
explicit-record
Project already-held SameDayDesk GET /extract or POST /extract/batch JSON into buyer-named records using explicit JSON Pointers and a local JSON Schema. Use when the caller already has observation JSON plus mapping and schema files. Do not fetch, pay, infer entities, or treat payment as useful output. Partial…
page-change
Offline compare of two extract-batch JSON field snapshots. Use when the caller already has two delivered POST /extract/batch JSON files and wants selected-field diffs without fetching, paying, retrying, or scheduling. Do not use to purchase a second observation.
aipou-farming
Record meaningful AI-assisted work as privacy-preserving AIPOU receipts and claim accumulated AIPOU rewards on Base. Use when a user asks to farm AIPOU, register an AI task, show their AIPOU identity, inspect pending receipts, estimate rewards, or claim AIPOU through the configured MCP server.
x402
Monetize any user project/service with the x402 payment protocol on platform networks (Base + Monad + Robinhood + X Layer + Solana; Starchild platform billing: payperuse / lifetime / weekly / monthly / quarterly / yearly / prepaid, plus multi-plan services), limited-time free promotions (amount-0 verify, no…