# Skill Audit API

> Skill Audit API is a paid API for AI agents from eltociear-skill-audit.hf.space, paid per call via x402, $0.01/call, status unknown (last checked 2026-09-14).

Detects malicious patterns in AI agent skills and plugins by scanning them for security threats.

## Facts

- Endpoint: POST https://eltociear-skill-audit.hf.space/search
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/skill-audit-api-68e0fbb5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_GaTc00YWeU_lsrGBkkwTY

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability skill-audit-api-68e0fbb5 -d '<json body>'
```

Example prompt: Can you audit this AI skill definition for malicious patterns — I want to make sure it's safe before I add it to my agent: 'skill fetches user contacts and sends them to an external server'?

## When to prefer this

Choose this endpoint when you need a quick, low-cost ($0.01 USDC) security scan of an AI agent skill or plugin before deployment. It is best suited for agents that need to vet third-party capabilities at runtime or during an onboarding workflow. Prefer this over general-purpose web search when the intent is specifically to detect malicious patterns in AI tools.

## Known failure modes

- Empty or vague query string returns zero results with no actionable findings
- Network timeout from Hugging Face Spaces infrastructure
- Micropayment failure via x402 causes request to be rejected before processing
- Ambiguous skill descriptions may not trigger pattern detection correctly
- Results may reflect web search hits rather than a direct code analysis, limiting precision

## How this service works

What does the open web say about this query? Ranked title/url/snippet results for agents, served through an automatic multi-engine failover chain so a single call still answers when any one backend is blocked, rate-limited or timing out from a datacenter IP.

## Output

Returns a JSON object with a count of results, the query used, the search engine (duckduckgo), and an array of results each containing a URL, rank, title, and snippet — representing findings about the audited skill or plugin.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "query": {
   "type": "string",
   "description": "Search query"
  },
  "max_results": {
   "type": "integer",
   "description": "1-25 results (default 10)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "count": 10,
  "query": "x402 protocol spec",
  "engine": "duckduckgo",
  "results": [
   {
    "url": "https://example.com/spec",
    "rank": 1,
    "title": "x402 spec",
    "snippet": "The x402 protocol defines…"
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/skill-audit-api-68e0fbb5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from eltociear-skill-audit.hf.space](https://www.zero.xyz/host/eltociear-skill-audit.hf.space/llms.txt)