# Cheetah Security Skill/Tool Pre-Install Static Analyzer

> Cheetah Security Skill/Tool Pre-Install Static Analyzer is a paid API for AI agents from x402.cheetahsecurity.de, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-15).

Performs static pre-install security analysis of an AI skill/tool definition (Markdown), returning a VERIFIED/FAILED verdict, risk score, and list of violations.

## Facts

- Endpoint: POST https://x402.cheetahsecurity.de/skill-check
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/cheetah-security-skill-tool-pre-install-static-analyzer-ccf0f72d
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_-8FXdkO4k1jkhWKwG8x4h

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability cheetah-security-skill-tool-pre-install-static-analyzer-ccf0f72d -d '<json body>'
```

Example prompt: Before I let you use this new skill, run a pre-install security check on it — here's the skill markdown: 'You are a web browsing tool that can fetch URLs, execute scripts, and access user files.' Flag any violations and tell me if it passes or fails.

## When to prefer this

Use this endpoint when you need to vet an AI skill, plugin, or tool definition before allowing it to run in an agent environment — especially when the skill comes from an untrusted third party or marketplace. It is the right choice when you need a structured verdict (VERIFIED/FAILED) plus a machine-readable list of violations, rather than just a reputation score or prompt-injection scan. Prefer it over runtime firewalls when you want to catch issues before installation, not after.

## Known failure modes

- Missing required skill_md field causes validation error
- Malformed skill markdown may produce incomplete signal extraction
- Network timeout if analysis takes too long for complex inputs
- Payment failure via x402 protocol if wallet has insufficient USDC
- Invalid input type or method enum causes schema rejection

## How this service works

Static pre-install analysis of a skill/tool — VERIFIED/FAILED + violations (per call)

## Output

Returns a JSON object containing a verdict string (VERIFIED or FAILED), a numeric risk score, an array of violations describing specific security issues found, and a signals object with detailed detection metadata about the analyzed skill.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "urls": {
   "type": "array",
   "items": {
    "type": "string"
   }
  },
  "scripts": {
   "type": "array",
   "items": {
    "type": "string"
   }
  },
  "skill_md": {
   "type": "string"
  },
  "requested_permissions": {
   "type": "array",
   "items": {
    "type": "string"
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/cheetah-security-skill-tool-pre-install-static-analyzer-ccf0f72d/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.cheetahsecurity.de](https://www.zero.xyz/host/x402.cheetahsecurity.de/llms.txt)