# skill-audit API – AI Agent Plugin Trust Scorer

> skill-audit API – AI Agent Plugin Trust Scorer is a paid API for AI agents from eltociear-skill-audit.hf.space, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-15).

Analyzes a given AI agent skill or plugin URL for malicious patterns, x402 payment validity, domain health, and content safety, returning a composite trust score and verdict.

## Facts

- Endpoint: POST https://eltociear-skill-audit.hf.space/trust
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/skill-audit-api-ai-agent-plugin-trust-scorer-1d1810e0
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_bFngr8Q3dWPaYPt0XDLO4

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability skill-audit-api-ai-agent-plugin-trust-scorer-1d1810e0 -d '<json body>'
```

Example prompt: Can you audit this AI plugin URL for me — https://some-tool.example.com — and tell me if it's safe to use, what its trust score is, and whether it has any malicious patterns?

## When to prefer this

Use this endpoint when you need a quick, multi-dimensional safety audit of an AI agent skill or x402-enabled API before allowing an agent to call it. It uniquely combines x402 payment challenge verification, domain reputation signals (SPF, DMARC), transport security, and content safety into a single trust score — making it ideal for agent orchestration pipelines that need to vet tools at runtime. Prefer this over generic URL scanners when the target is specifically an AI plugin or x402 micropayment API.

## Known failure modes

- Unreachable target URL returns error or timeout
- Invalid URL format causes 400 Bad Request
- Target endpoint blocks audit probe requests, skewing scores
- x402 challenge validation fails if endpoint uses non-standard implementation
- Hugging Face Space may be cold-started, adding initial latency
- Payment via x402 required — missing USDC on Base wallet causes auth failure

## How this service works

Vet an x402 server or any URL for scam/phishing/trust in ONE call: transport, content-safety, domain, metadata + x402-compliance sub-scores, each with transparent evidence

## Output

Returns a JSON object containing: a boolean is_scam flag, a human-readable verdict string, an overall trust_score (0–100), a risk_level (low/medium/high), sub-scores for x402 validity, domain, metadata, transport, and content safety, plus evidence details including SPF/DMARC status, latency in ms, missing security headers, and malicious findings count.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "format": "uri",
   "description": "x402 server or URL to vet before trusting/paying it"
  },
  "check_x402": {
   "type": "boolean",
   "description": "Probe for a valid x402 402 challenge (default true)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "url": "https://some-x402-api.example.com",
  "x402": {
   "asset": "USDC",
   "pay_to": "0x…",
   "is_x402": true,
   "network": "eip155:8453",
   "valid_challenge": true
  },
  "is_scam": false,
  "verdict": "Reachable HTTPS endpoint with strong headers, valid x402 challenge, no malicious patterns.",
  "evidence": {
   "spf": true,
   "dmarc": true,
   "latency_ms": 210,
   "missing_headers": [
    "content-security-policy"
   ],
   "malicious_findings": 0
  },
  "risk_level": "low",
  "sub_scores": {
   "x402": 100,
   "domain": 70,
   "metadata": 80,
   "transport": 90,
   "content_safety": 100
  },
  "trust_score": 82
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/skill-audit-api-ai-agent-plugin-trust-scorer-1d1810e0/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from eltociear-skill-audit.hf.space](https://www.zero.xyz/host/eltociear-skill-audit.hf.space/llms.txt)