# Orac Safety Layer — AI Agent Security API (Code Audit)

> Orac Safety Layer — AI Agent Security API (Code Audit) is a paid API for AI agents from orac-safety.orac.workers.dev, paid per call via x402, $0.1/call, status unknown (last checked 2026-10-12).

Audits skill source code for security vulnerabilities, returning a risk score, severity-bucketed findings, and a PASS/FAIL verdict

## Facts

- Endpoint: POST https://orac-safety.orac.workers.dev/v1/audit?utm_source=zero.xyz
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/orac-safety-layer-ai-agent-security-api-code-audit-4bdc7d2f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_mOSGDNd7NBUh0Jkr78weA

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability orac-safety-layer-ai-agent-security-api-code-audit-4bdc7d2f -d '<json body>'
```

Example prompt: Can you audit this skill.js source code for security vulnerabilities and tell me the risk score, any critical or high findings, and whether it passes or fails?

## When to prefer this

Use this endpoint when you need static security analysis of AI agent skill source code specifically — especially when checking for credential exfiltration, unsafe fetch patterns, or other agent-specific attack vectors before deployment. Prefer this over generic SAST tools when auditing skills in the AI agent ecosystem context.

## Known failure modes

- Code exceeds 200,000 character limit — request rejected
- Missing required 'code' field — 400 Bad Request
- Malformed JSON body — parse error response
- Payment not completed — 402 Payment Required
- Service unavailable or timeout — 5xx error

## How this service works

Audit skill source code for security vulnerabilities

## Output

Returns a JSON object with a meta block (service version, filename, lines of code, number of patterns checked), a summary of findings by severity (low, medium, high, critical), a PASS/FAIL verdict, an array of detailed findings each with an ID, severity, and description, and an overall numeric risk score from 0–100.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "code"
 ],
 "properties": {
  "code": {
   "type": "string",
   "maxLength": 200000,
   "description": "Source code to audit for security vulnerabilities"
  },
  "filename": {
   "type": "string",
   "description": "Original filename (for context in report)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "meta": {
  "service": "orac-safety-layer",
  "version": "1.0.0",
  "filename": "skill.js",
  "linesOfCode": 2,
  "patternsChecked": 16
 },
 "summary": {
  "low": 0,
  "high": 1,
  "medium": 0,
  "critical": 1
 },
 "verdict": "FAIL",
 "findings": [
  {
   "id": "CRED_EXFIL",
   "severity": "critical",
   "description": "Potential credential exfiltration via fetch()"
  }
 ],
 "riskScore": 77
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/orac-safety-layer-ai-agent-security-api-code-audit-4bdc7d2f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from orac-safety.orac.workers.dev](https://www.zero.xyz/host/orac-safety.orac.workers.dev/llms.txt)