# Skill Audit API

> Skill Audit API is a paid API for AI agents from eltociear-skill-audit.hf.space, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

Detects malicious patterns and security risks in AI agent skills and plugins

## Facts

- Endpoint: POST https://eltociear-skill-audit.hf.space/audit
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/skill-audit-api-4987bb8e
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_wofgYRerYdxU6s_Px8dmO

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability skill-audit-api-4987bb8e -d '<json body>'
```

Example prompt: Can you audit this AI agent skill definition and tell me if it contains any malicious patterns or security risks — I need to know the risk score and what findings were detected before I let it run.

## When to prefer this

Use this endpoint when you need to programmatically audit AI agent skills or plugins for malicious patterns before deployment or execution. Particularly useful in automated agent pipelines where untrusted third-party plugins need security vetting. Prefer over manual review when operating at scale or when integrating security checks into an agent orchestration workflow.

## Known failure modes

- Invalid or unparseable skill/plugin input returns an error
- Missing required skill payload returns 400-level error
- Payment not provided or insufficient USDC results in 402 payment required
- Service unavailable on Hugging Face Spaces returns 503
- Skill too large or complex may exceed processing limits

## How this service works

Audit text for malicious AI-skill patterns

## Output

Returns a JSON object with: findings (array of detected issues), risk_level (e.g. 'clean' or severity label), risk_score (numeric score), and total_findings (count of issues found).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "content": {
   "type": "string",
   "description": "Text to audit"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "findings": [],
  "risk_level": "clean",
  "risk_score": 0,
  "total_findings": 0
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/skill-audit-api-4987bb8e/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from eltociear-skill-audit.hf.space](https://www.zero.xyz/host/eltociear-skill-audit.hf.space/llms.txt)