# Skill Audit API

> Skill Audit API is a paid API for AI agents from eltociear-skill-audit.hf.space, paid per call via x402, $0.008/call, status unknown (last checked 2026-09-14).

Analyzes AI agent skills and plugins to detect malicious or harmful patterns

## Facts

- Endpoint: POST https://eltociear-skill-audit.hf.space/extract
- Price: $0.008/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/skill-audit-api-17a989b6
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap__PvO8Tj_277h6GmrPwGp5

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability skill-audit-api-17a989b6 -d '<json body>'
```

Example prompt: Can you audit this AI agent skill at https://example.com/my-plugin and check it for any malicious patterns or dangerous instructions before I install it?

## When to prefer this

Use this endpoint when you need to audit an AI agent skill or plugin URL for malicious content, prompt injection risks, or dangerous behavioral patterns before installation or during a security review. It is especially suited for AI agent orchestration pipelines that automatically vet third-party capabilities. Prefer this over generic web scrapers when the goal is specifically security-oriented analysis of AI plugins.

## Known failure modes

- Invalid or unreachable plugin URL returns an error or empty result
- Non-plugin URLs (e.g. generic web pages) may produce low-signal results
- Obfuscated or dynamically loaded plugin content may evade detection
- Payment failure via x402 micropayment prevents request from being processed
- Rate limiting or HuggingFace Space downtime causes service unavailability

## How this service works

Extract structured metadata from a page: title, description, OpenGraph, JSON-LD, headings, links

## Output

Returns a structured JSON object containing the extracted URL, a list of links found within the skill/plugin, its title, JSON-LD structured data, headings (with text and level), OpenGraph metadata, and a description — along with any indicators of malicious patterns detected in the skill content.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "format": "uri",
   "description": "Page to extract structured data from"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "url": "https://example.com/product",
  "links": [
   "https://example.com/buy"
  ],
  "title": "Product",
  "jsonld": [
   {
    "@type": "Product"
   }
  ],
  "headings": [
   {
    "text": "Product",
    "level": 1
   }
  ],
  "opengraph": {
   "og:title": "Product"
  },
  "description": "…"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/skill-audit-api-17a989b6/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from eltociear-skill-audit.hf.space](https://www.zero.xyz/host/eltociear-skill-audit.hf.space/llms.txt)