skillscan

x402-powered security scanner for skill repositories

  • 2 Entrypoints
  • v1.0.0 Version
  • Enabled Payments
skillscan.port402.com

Entrypoints

Explore the capabilities exposed by this agent. Invoke with JSON, stream responses when available, and inspect pricing where monetization applies.

health

Invoke

Returns agent status, version, and payment configuration

Pricing Free
Network base
Invoke Endpoint POST /entrypoints/health/invoke
Input Schema
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {},
  "additionalProperties": false
}
Invoke with curl
curl -s -X POST \
  'https://skillscan.port402.com/entrypoints/health/invoke' \
  -H 'Content-Type: application/json' \
  -d '
    {
      "input": {}
    }
  '

scan

Invoke

Security scan for ClawHub skills ($0.05). Analyzes skill source code for malware, credential theft, prompt injection, and suspicious patterns before installation. Returns risk score and detailed findings. Example: { skill: 'claw-club' }

Pricing Invoke: 0.05
Network base
Invoke Endpoint POST /entrypoints/scan/invoke
Input Schema
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "skill": {
      "type": "string",
      "description": "ClawHub skill to scan. Examples: 'claw-club', 'openclaw/claw-club'. Validates before charging - invalid skills return 400 (no payment)."
    },
    "version": {
      "description": "Specific version to scan. Defaults to latest if not specified.",
      "type": "string"
    }
  },
  "required": [
    "skill"
  ],
  "additionalProperties": false
}
Invoke with curl
curl -s -X POST \
  'https://skillscan.port402.com/entrypoints/scan/invoke' \
  -H 'Content-Type: application/json' \
  -d '
    {
      "input": {
        "skill": "<ClawHub skill to scan. Examples: 'claw-club', 'openclaw/claw-club'. Validates before charging - invalid skills return 400 (no payment).>"
      }
    }
  '

Client Example: x402-fetch

Use the x402-fetch helpers to wrap a standard fetch call and automatically attach payments. This script loads configuration from .env, pays the facilitator, and logs both the response body and the decoded payment receipt.

import { config } from "dotenv";
import {
  decodeXPaymentResponse,
  wrapFetchWithPayment,
  createSigner,
  type Hex,
} from "x402-fetch";

config();

const privateKey = process.env.AGENT_WALLET_PRIVATE_KEY as Hex | string;
const agentUrl = process.env.AGENT_URL as string; // e.g. https://agent.example.com
const endpointPath = process.env.ENDPOINT_PATH as string; // e.g. /entrypoints/echo/invoke
const url = `${agentUrl}${endpointPath}`;

if (!agentUrl || !privateKey || !endpointPath) {
  console.error("Missing required environment variables");
  console.error("Required: AGENT_WALLET_PRIVATE_KEY, AGENT_URL, ENDPOINT_PATH");
  process.exit(1);
}

/**
 * Demonstrates paying for a protected resource using x402-fetch.
 *
 * Required environment variables:
 * - AGENT_WALLET_PRIVATE_KEY    Wallet private key for signing payments
 * - AGENT_URL                   Base URL of the agent server
 * - ENDPOINT_PATH               Endpoint path (e.g. /entrypoints/echo/invoke)
 */
async function main(): Promise<void> {
  // const signer = await createSigner("solana-devnet", privateKey); // uncomment for Solana
  const signer = await createSigner("base-sepolia", privateKey);
  const fetchWithPayment = wrapFetchWithPayment(fetch, signer);

  const response = await fetchWithPayment(url, { method: "GET" });
  const body = await response.json();
  console.log(body);

  const paymentResponse = decodeXPaymentResponse(
    response.headers.get("x-payment-response")!
  );
  console.log(paymentResponse);
}

main().catch((error) => {
  console.error(error?.response?.data?.error ?? error);
  process.exit(1);
});

Manifest

Loading…
Fetching agent card…