# Skill Audit API

> Skill Audit API is a paid API for AI agents from eltociear-skill-audit.hf.space, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-13).

Scans a GitHub repository containing AI agent skills or plugins for malicious patterns, returning a risk score and list of flagged files.

## Facts

- Endpoint: POST https://eltociear-skill-audit.hf.space/audit/repo
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/skill-audit-api-b2db7fb7
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_2SWmyQkhArsWzu4XqbUJK

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability skill-audit-api-b2db7fb7 -d '<json body>'
```

Example prompt: Can you audit the GitHub repo 'someuser/my-agent-skill' for malicious patterns before I add it to my agent fleet? I need to know the risk level and any flagged files.

## When to prefer this

Use this endpoint when you need a quick, automated security risk assessment of a GitHub repository containing AI agent skills or plugins before integrating them into an agent system. It is purpose-built for the AI agent plugin security domain, unlike generic static analysis tools or SCA scanners.

## Known failure modes

- Invalid or non-existent repository identifier returns an error
- Private repositories may not be accessible without credentials
- Rate limiting or payment failure returns a 402 response
- Large repositories may time out or return partial results
- Obfuscated malicious code may evade pattern detection

## How this service works

Scan an entire public GitHub repo for malicious AI-skill/supply-chain patterns

## Output

A JSON object with the repository name, an overall risk_level string (e.g. 'clean', 'low', 'high'), a numeric risk_score, the count of files_scanned, a list of flagged_files with details, and a total_findings count.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "ref": {
   "type": "string",
   "description": "Branch/tag/sha (default: HEAD)"
  },
  "repo": {
   "type": "string",
   "description": "GitHub repo as 'owner/name' or full URL"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "repo": "owner/name",
  "risk_level": "clean",
  "risk_score": 0,
  "files_scanned": 84,
  "flagged_files": [],
  "total_findings": 0
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/skill-audit-api-b2db7fb7/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from eltociear-skill-audit.hf.space](https://www.zero.xyz/host/eltociear-skill-audit.hf.space/llms.txt)