# Power Strip Security – Agent Skill Audit

> Power Strip Security – Agent Skill Audit is a paid API for AI agents from api.powerstripsecurity.workers.dev, paid per call via x402, $0.005/call, status unknown (last checked 2026-11-01).

Statically audits SKILL.md, AGENTS.md, CLAUDE.md, .cursorrules, and related agent skill files for security threats like prompt injection, credential theft, and malicious commands before an agent loads them.

## Facts

- Endpoint: POST https://api.powerstripsecurity.workers.dev/v1/skill-audit?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-11-01
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/power-strip-security-agent-skill-audit-72baea0b
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_YEKVi_zVIWrMNr_9EEeMc

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability power-strip-security-agent-skill-audit-72baea0b -d '<json body>'
```

Example prompt: Before we load this new SKILL.md into production, can you run a security audit on it to check for prompt injection, hardcoded credentials, curl-pipe-bash patterns, or any exfiltration attempts? Here are the file contents: [paste SKILL.md content].

## When to prefer this

Choose this endpoint when you need static security analysis specifically of agent skill definition files (SKILL.md, AGENTS.md, CLAUDE.md, .cursorrules, skill scripts) before an agent loads them — particularly in CI/CD pipelines or PR review workflows. It is purpose-built for agentic supply-chain threats rather than general web content or MCP server auditing (use sibling endpoints for those). Ideal when you want cheap-enough-for-every-PR automated skill file vetting.

## Known failure modes

- Empty or missing files array and no URL provided — returns error requesting input
- URL provided but page is inaccessible or returns non-200 — returns fetch error
- File content too large — may return truncation or size limit error
- Malformed JSON input — returns 400 validation error
- Payment not processed via x402 — returns 402 Payment Required before scan runs

## How this service works

Agent skill audit: check a SKILL.md folder (scripts, references) or AGENTS.md, CLAUDE.md, .cursorrules before an agent loads it. Findings by file and line: prompt injection, curl | bash, encoded commands, credential theft, exfiltration, hardcoded keys, persistence, spec errors. Paste the files or one URL. Nothing runs, nothing is stored. Cheap enough for every PR. Also: /v1/read $0.005, /v1/scan $0.002, /v1/mcp-audit $0.01, /v1/skill-audit $0.005. Remote MCP: /mcp. 10 free/new wallet.

## Output

Returns a structured list of security findings organized by file and line number, covering threat categories including prompt injection, curl|bash patterns, base64/encoded commands, credential theft, data exfiltration attempts, hardcoded API keys or secrets, persistence mechanisms, and specification errors. Each finding identifies the specific file, line, and nature of the threat.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "files": {
   "type": "array",
   "items": {
    "type": "object"
   },
   "description": "Skill files as {path, content}: SKILL.md, scripts, references, AGENTS.md. Or send url."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/power-strip-security-agent-skill-audit-72baea0b/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.powerstripsecurity.workers.dev](https://www.zero.xyz/host/api.powerstripsecurity.workers.dev/llms.txt)