genesiscode2026/genesis-agent-skills-qa · v1.0.0

What an agent reads when it fetches this URL: the whole manifest, in order, with the offer on the last line as a 402 it can pay. Nothing here is a button — an agent does not click, it signs. The page a person reads is here.

Pack · 3 skills · 1 script · 3 source files · 2 test files · 5 docs · 1 config file · 1 asset · 1 other file · 17 files · text 25.1 kB · binary 6 B (0%) · JavaScript 100% · licence undetermined

scan passed 2026-09-17 · scanner 2026.09.1 · 1 release · last release today · 0% of files seen elsewhere

computed 2026-09-17 11:28 UTC · analyzer 0.1.0

Security scan report

Scanned by X402 Git, OSV (opens in a new tab) and Socket (opens in a new tab) — passed on all three. Findings from X402 Git and Socket are listed below.

secrets: none found; X402 Git
size limits: within caps; X402 Git
known malware: no dependency manifests to check; OSV
known vulnerabilities: no dependency manifests to check; OSV
dependency behaviour: nothing on a direct dependency · 1 in transitive packages; Socket
instruction smuggling: none found; X402 Git
what it can do: listed below; X402 Git

What this can do

Tools: none
Runs: bin/genesis-skills-qa.js
tests/fixtures/valid_skill/scripts/run_analysis.sh
Talks to: nothing
Reads: no environment variables
At install: nothing runs

Findings (3)

LOWSocket SBOM Resolver — Socket SBOM Resolver (transitive) — no lockfile, so installs are not reproducible
LOWbin/genesis-skills-qa.js — Ships the script bin/genesis-skills-qa.js
LOWtests/fixtures/valid_skill/scripts/run_analysis.sh — Ships the script tests/fixtures/valid_skill/scripts/run_analysis.sh

Description self_reported

Written by the creator. Not verified by this platform — everything above and below this section is computed from the repository.

Lint and package Agent Skills with 0 config. Validates skill metadata and specifications.

When to use it. When requiring verified Agent Tooling functionality in autonomous workflows

Readme

Genesis Agent Skills QA & Packager

Deterministic quality assurance, security auditing, and packaging harness for Agent Skills (SKILL.md) in modern coding-agent ecosystems (Codex CLI, Claude Code, Cursor, Gemini).

1. What Problem Does This Solve?

Teams building custom Agent Skills encounter silent failures in production:

Malformed YAML frontmatter that agents cannot parse.
Broken local path references to missing helper scripts.
Bloated context payloads (>50KB) that blow out token windows.
Accidental embedding of developer API keys, private keys, or credentials.
Destructive commands (rm -rf, sudo, curl | sh) embedded in agent prompts.

genesis-skills-qa deterministically catches these issues in CI or pre-commit before deployment and bundles passing skills into tamper-evident .skill.tar.gz packages with SHA-256 integrity manifests.

2. Who Buys It?

AI Engineers and Prompt Engineers maintaining Agent Skill libraries.
Engineering teams deploying autonomous coding agents (Codex / Claude Code / Cursor).
Enterprise platform teams enforcing security boundaries on agent capabilities.

3. What Does It Output?

Human-readable terminal diagnostic table with exact line citations.
Machine-readable JSON output (--json) for CI/CD gates.
Signed SHA-256 distribution bundle (.skill.tar.gz) with .skill-manifest.json.

4. How Fast Can You Test It?

Under 5 seconds. Run:

./bin/genesis-skills-qa.js ./tests/fixtures/valid_skill

5. Why Is This Different From Generic Markdown Linters?

Generic markdown linters only check syntax. genesis-skills-qa is purpose-built for the 2026 Agent Skill standard: it audits token context budgets, verifies executable script references, scans for API key entropy, and prevents dangerous escalation commands from entering agent memory.

Installation & Quickstart

# Verify a skill directory
npx genesis-skills-qa ./my-skill

# Run in CI with JSON output and exit code
npx genesis-skills-qa ./my-skill --json

# Package verified skill for distribution
npx genesis-skills-qa ./my-skill --package --out ./dist/my-skill.skill.tar.gz

Diagnostic Rules Evaluated

Rule ID	Severity	Description
`SKILL_MD_EXISTS`	FAIL	Checks for presence of `SKILL.md` at root
`FRONTMATTER_SCHEMA`	FAIL	Validates YAML delimiters and key-value structure
`FRONTMATTER_NAME`	FAIL	Enforces non-empty name identifier
`FRONTMATTER_DESC`	FAIL	Enforces actionable description for agent tool routing
`PAYLOAD_BUDGET`	WARN / FAIL	Flags context bloat (>15KB warning, >50KB failure)
`SECURITY_SECRET_LEAK`	FAIL	Scans for OpenAI, GitHub, Slack tokens, private keys
`SECURITY_DANGEROUS_CMD`	WARN / FAIL	Detects destructive commands (`rm -rf`, `sudo`, `curl\|sh`)
`BROKEN_LOCAL_LINK`	WARN	Verifies existence of local files referenced in markdown

License

Commercial — Genesis Code (genesiscode2026). See LICENSE.

17 files · 25.1 kB · computed 2026-09-17
Size	Path
103 B	.gitignore
556 B	CHANGELOG.md
961 B	LICENSE
1.1 kB	QUICKSTART.md
3 kB	README.md
370 B	SECURITY.md
6 B	VERSION · binary
4 kB	bin/genesis-skills-qa.js
641 B	package.json
336 B	src/index.js
2.5 kB	src/packager.js
8 kB	src/validator.js
130 B	tests/fixtures/broken_skill/SKILL.md
249 B	tests/fixtures/dangerous_skill/SKILL.md
369 B	tests/fixtures/valid_skill/SKILL.md
81 B	tests/fixtures/valid_skill/scripts/run_analysis.sh
2.7 kB	tests/test_validator.js

computed 2026-09-17 11:28 UTC · analyzer 0.1.0

Dependencies

None found in the software bill of materials for this release.

computed 2026-09-17 11:28 UTC · analyzer 0.1.0

Releases

1 release · last release today
Version	Date	Scan	Changed	Notes
v1.0.0	2026-09-17	pass	—	Production-ready release of Agent Skills QA & Packager. Validates, packages, and quality-assures agent skill definitions.

Machine-readable at https://x402git.com/api/v/genesiscode2026/genesis-agent-skills-qa/releases. Entries cannot be deleted by the creator.

Order

GET v1.0.0 · $29 · new releases $5

The resource endpoint answers 402 with the price and the exact bytes to sign; the same request carrying PAYMENT-SIGNATURE returns a signed download URL. Access is granted only after settlement returns a transaction hash. A person can do the same thing with a browser wallet on the product page.

# the 402, with the price and the exact bytes to sign
curl -si https://x402git.com/api/r/genesiscode2026/genesis-agent-skills-qa

# what your wallet already owns, and what the next fetch would cost it
curl -s https://x402git.com/api/v/genesiscode2026/genesis-agent-skills-qa \
  -H "X-Wallet-Signature: 0xYOURADDRESS.<nonce>.<signature>"

The first request answers this — a real quote, made for this page load:

HTTP/1.1 402 Payment Required
Content-Type: application/json

{
  "x402Version": 2,
  "resource": {
    "url": "https://x402git.com/api/r/genesiscode2026/genesis-agent-skills-qa",
    "description": "genesiscode2026/genesis-agent-skills-qa v1.0.0 — release. Lint and package Agent Skills with 0 config. Validates skill metadata and specifications. Security scan passed; signed download, 5-minute URL.",
    "mimeType": "application/zip",
    "serviceName": "genesis-agent-skills-qa",
    "tags": [
      "pack",
      "skills",
      "scripts",
      "source",
      "tests"
    ]
  },
  "accepts": [
    {
      "scheme": "exact",
      "network": "eip155:8453",
      "amount": "29000000",
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "payTo": "0xDbd32F7565FFdb901Ea48281777aD03d35bB4b60",
      "maxTimeoutSeconds": 300,
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "maxAmountRequired": "29000000",
      "resource": "https://x402git.com/api/r/genesiscode2026/genesis-agent-skills-qa",
      "description": "genesiscode2026/genesis-agent-skills-qa v1.0.0 — release. Lint and package Agent Skills with 0 config. Validates skill metadata and specifications. Security scan passed; signed download, 5-minute URL.",
      "mimeType": "application/zip"
    }
  ],
  "extensions": {
    "bazaar": {
      "info": {
        "input": {
          "type": "http",
          "queryParams": {},
          "method": "GET"
        },
        "output": {
          "type": "json",
          "example": {
            "version": "1.0.0",
            "artifact_sha256": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
            "download_url": "https://storage.example/genesiscode2026/genesis-agent-skills-qa/1.0.0.zip?signed=…",
            "expires_at": "2026-09-16T12:05:00.000Z",
            "version_endpoint": "https://x402git.com/api/r/genesiscode2026/genesis-agent-skills-qa/v/1.0.0",
            "manifest_url": "https://x402git.com/api/label/genesiscode2026/genesis-agent-skills-qa",
            "all_versions": false
          }
        }
      },
      "schema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "type": "object",
        "properties": {
          "input": {
            "type": "object",
            "properties": {
              "type": {
                "type": "string",
                "const": "http"
              },
              "method": {
                "type": "string",
                "enum": [
                  "GET"
                ]
              },
              "queryParams": {
                "type": "object",
                "properties": {}
              }
            },
            "required": [
              "type",
              "method"
            ],
            "additionalProperties": false
          },
          "output": {
            "type": "object",
            "properties": {
              "type": {
                "type": "string"
              },
              "example": {
                "type": "object",
                "properties": {
                  "version": {
                    "type": "string",
                    "description": "Semantic version of the release served."
                  },
                  "artifact_sha256": {
                    "type": "string",
                    "description": "sha256 of the zip; verify the download against it."
                  },
                  "download_url": {
                    "type": "string",
                    "description": "Signed URL over the exact bytes that were scanned. Valid five minutes."
                  },
                  "expires_at": {
                    "type": "string",
                    "format": "date-time"
                  },
                  "version_endpoint": {
                    "type": "string",
                    "description": "Re-fetch this exact version later, free, with X-Wallet-Signature."
                  },
                  "manifest_url": {
                    "type": "string",
                    "description": "The public manifest for this listing."
                  },
                  "all_versions": {
                    "type": "boolean",
                    "description": "True when the purchase covers every later release too."
                  }
                },
                "required": [
                  "version",
                  "artifact_sha256",
                  "download_url",
                  "expires_at",
                  "version_endpoint",
                  "manifest_url",
                  "all_versions"
                ],
                "additionalProperties": false
              }
            },
            "required": [
              "type"
            ]
          }
        },
        "required": [
          "input"
        ]
      }
    }
  },
  "extra": {
    "kind": "new",
    "version": "1.0.0",
    "manifest_url": "https://x402git.com/api/label/genesiscode2026/genesis-agent-skills-qa",
    "scan_badge_url": "https://x402git.com/api/label/genesiscode2026/genesis-agent-skills-qa#scan",
    "update_price_micro": "5000000",
    "quote_id": "q_16a517463946f2bf47fa8f06984066be",
    "valid_before": "2026-09-17T14:56:44.558Z",
    "instructions": "This is an x402 paywall, not an error. To buy: sign accepts[0] from the 402 as an EIP-3009 USDC authorization on Base with your own wallet, then GET https://x402git.com/api/r/genesiscode2026/genesis-agent-skills-qa again with the payment in the PAYMENT-SIGNATURE header and extra.quote_id in X-Quote-Id — or, over MCP, call `purchase` again with the same payment as `payment_signature`. The full procedure is at https://x402git.com/.well-known/agent-skills/buy-a-repo/SKILL.md; the same tools are an MCP server at https://x402git.com/api/mcp. No wallet? A person can buy at https://x402git.com/genesiscode2026/genesis-agent-skills-qa, and the free manifest at https://x402git.com/api/label/genesiscode2026/genesis-agent-skills-qa shows what is inside before anyone pays.",
    "listing_url": "https://x402git.com/genesiscode2026/genesis-agent-skills-qa",
    "skill_url": "https://x402git.com/.well-known/agent-skills/buy-a-repo/SKILL.md",
    "mcp_url": "https://x402git.com/api/mcp"
  }
}

Resource: https://x402git.com/api/r/genesiscode2026/genesis-agent-skills-qa
Manifest: https://x402git.com/api/label/genesiscode2026/genesis-agent-skills-qa
Version: https://x402git.com/api/v/genesiscode2026/genesis-agent-skills-qa
Artifact sha256: 981e361b8d27778ad66ec7a75dcca5f4aef21500a378bafd53a72885d0ee8a16

Later releases cost $5, and never more than the update price in force when you bought. One charge per update, whatever the release cadence.

Sold by genesiscode2026. Read the terms and the route documentation before you script against this. Base URL https://x402git.com.

genesiscode2026/genesis-agent-skills-qa · v1.0.0

Security scan report

What this can do

Description self_reported

Readme

Genesis Agent Skills QA & Packager

1. What Problem Does This Solve?

2. Who Buys It?

3. What Does It Output?

4. How Fast Can You Test It?

5. Why Is This Different From Generic Markdown Linters?

Installation & Quickstart

Diagnostic Rules Evaluated

License

Contents

Dependencies

Releases

Order