# Skill-Audit API

> Skill-Audit API is a paid API for AI agents from eltociear-skill-audit.hf.space, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-14).

Crawls a URL and detects malicious or suspicious patterns in AI agent skills and plugins by analyzing fetched page content.

## Facts

- Endpoint: POST https://eltociear-skill-audit.hf.space/crawl
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/skill-audit-api-110f0499
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_jX_inhGD_Up6KSMVbISJZ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability skill-audit-api-110f0499 -d '<json body>'
```

Example prompt: Can you audit this AI plugin for me and check if it contains any malicious patterns or suspicious behavior? Here's the URL: https://example.com/plugin/manifest.json

## When to prefer this

Choose this endpoint when you need to programmatically audit an AI agent skill, plugin, or extension URL for malicious content, prompt injection, or suspicious behavioral patterns before deployment or installation. It is particularly well-suited for security-conscious agent pipelines, CI/CD validation flows, or marketplace vetting workflows where automated safety checks on third-party tools are required.

## Known failure modes

- Target URL is unreachable or returns a non-200 status, resulting in empty pages array
- URL points to non-HTML content (e.g. binary file) that cannot be parsed into markdown
- Rate limiting or bot-blocking by the target server prevents crawling
- Payment failure via x402 micropayment protocol causes request rejection
- Malformed URL input causes crawl to fail immediately
- Deep or large sites may exceed crawl limits, returning partial results

## How this service works

Crawl a site from a start URL (same-domain, breadth-first) and return each page as clean Markdown

## Output

Returns a JSON object containing the number of pages successfully crawled (ok), the start URL, the count of pages fetched, and an array of page objects each with URL, depth, title, markdown content, and word count — allowing downstream analysis of crawled skill/plugin content for malicious patterns.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "format": "uri",
   "description": "Start URL"
  },
  "max_pages": {
   "type": "integer",
   "description": "1-10 pages to fetch (default 5)"
  },
  "include_links": {
   "type": "boolean",
   "description": "Keep hyperlinks (default true)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": 5,
  "pages": [
   {
    "url": "https://example.com/docs",
    "depth": 0,
    "title": "Docs",
    "markdown": "# Docs…",
    "word_count": 800
   }
  ],
  "start_url": "https://example.com/docs",
  "pages_fetched": 5
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/skill-audit-api-110f0499/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from eltociear-skill-audit.hf.space](https://www.zero.xyz/host/eltociear-skill-audit.hf.space/llms.txt)