# ShieldAPI AI Skill/Plugin Supply Chain Security Scanner

> ShieldAPI AI Skill/Plugin Supply Chain Security Scanner is a paid API for AI agents from shield.vainplex.dev, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-14).

Scans the text of an AI skill or plugin for supply chain vulnerabilities, prompt injection risks, and malicious patterns before an agent installs or executes it

## Facts

- Endpoint: POST https://shield.vainplex.dev/api/cdp/scan-skill
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/shieldapi-ai-skill-plugin-supply-chain-security-scanner-e83a7e08
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_IT5gyal-9rncFW04V34LG

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability shieldapi-ai-skill-plugin-supply-chain-security-scanner-e83a7e08 -d '<json body>'
```

Example prompt: Before I install this new AI skill, scan it for supply chain vulnerabilities and prompt injection risks — here's the full skill definition text: [paste skill text].

## When to prefer this

Choose this endpoint when you need to vet the text of an AI skill, plugin, or tool definition for supply chain attacks, prompt injection, or malicious behavior before your agent installs or executes it — especially when consuming third-party plugins from marketplaces, GitHub, or untrusted sources. Prefer this over generic code scanners when the target is specifically an AI agent skill or plugin format.

## Known failure modes

- Empty or missing skill text returns a validation error
- Skill text exceeding 10,000 characters is rejected
- Payment not fulfilled triggers HTTP 402 response
- Malformed input object or missing required fields returns a schema validation error
- Network timeout if the analysis takes too long for very large inputs

## How this service works

ShieldAPI - AI skill/plugin supply chain security scanner

## Output

Returns a structured security assessment of the submitted skill/plugin text, including identified vulnerabilities, prompt injection indicators, supply chain risk signals, and an overall security verdict or risk score.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "POST"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "skill"
     ],
     "properties": {
      "skill": {
       "type": "string",
       "maxLength": 10000,
       "description": "Text of the skill or plugin to scan for vulnerabilities"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/shieldapi-ai-skill-plugin-supply-chain-security-scanner-e83a7e08/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from shield.vainplex.dev](https://www.zero.xyz/host/shield.vainplex.dev/llms.txt)