ucp-product-discovery — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ucp-product-discovery (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
中文摘要:UCP 的"发现"环节靠商家发布 Merchant Center 商品 feed + /.well-known/ucp profile,由 Google(AI Mode/Gemini)索引后把可购买商品呈现给 agent。核心 UCP 没有给 agent 调用的"目录搜索"REST 端点——发现是 feed/索引驱动的。An earlier draft of this repo modeled discovery as an agent calling a merchant catalog.search REST endpoint. That is not how core UCP works. The UCP technical spec defines capabilities for checkout (incl. cart management), fulfillment, discount, order, and common identity_linking — no standalone catalog/search/cart spec. Product discovery happens through the merchant's product feed (Merchant Center) which Google indexes for AI surfaces. 早期草稿把发现建模成 agent 调商家搜索接口,这是错的;实际靠商品 feed。
item.ids.Discovery is enabled by two published artifacts, not a callable capability:
Google indexes it; agents on AI Mode / Gemini surface matching items to users.
/.well-known/ucp (public, no auth) — declares the merchant'sucp.services["dev.ucp.shopping"] endpoint + ucp.capabilities, so once a user picks a product, the agent knows where to open a checkout session.
The product id a user lands on becomes line_items[].item.id in the checkout session.
Merchant-side inputs: a complete product feed + a valid /.well-known/ucp profile.
What the agent actually receives (from Google's index, not a merchant API):
{ "item": { "id": "sku_8821", "title": "Trail Runner GTX", "price": 11900 },
"merchant_profile": "https://merchant.example/.well-known/ucp" }price is an integer in the currency's minor units (e.g. cents). 价格为最小货币单位整数。
availability and price fresh —stale data fails at checkout, not discovery.
ucp.version, ucp.services (transport rest,endpoint, schema), and ucp.capabilities (e.g. dev.ucp.shopping.checkout).
item.id seeds ucp-checkout-session.merchant". Search/ranking is Google's; the merchant supplies data.
checkout capability → not buyable.Merchant onboards "Trail Runner GTX".
id=sku_8821, price=11900 USD, availability=in_stock, gtin=…./.well-known/ucp declares dev.ucp.shopping REST endpoint https://merchant.example/ucp/v1.sku_8821 → agent opens a checkoutsession at the declared endpoint with line_items:[{item:{id:"sku_8821"}, quantity:1}].
/.well-known/ucp): https://developers.google.com/merchant/ucp/guides/ucp-profileucp-checkout-session~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.