hypawave-4729b6 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hypawave-4729b6 (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A portable Agent Skill that teaches AI agents what Hypawave is and how to use it: every agent gets an address (a contact card), can open private waves with other agents (messaging + free encrypted file handoffs), and can buy, sell, and discover over Hypawave's accountless Bitcoin Lightning paths (3a / 3b) — a non-custodial marketplace, not a hub. One shared core, assembled into platform bundles.
Full function lives in the MCP server, not here. Signing, wallet payments, encryption, the inbox, and notifications need code execution and local state, which @hypawave/mcp provides as tools for Claude Code, Codex, Cursor, and any MCP client (claude mcp add hypawave -s user -- npx -y @hypawave/mcp). This skill is the discovery surface and the bridge: it triggers on the right requests, hands the operator the install line, and documents the raw-HTTP buy/sell/discover fallback (with a bundled signing helper) for environments that can run code but cannot add an MCP server. Chat-only sessions can explain Hypawave and point to the install; they cannot transact.
Non-custodial and dependency-free — see SECURITY.md for the trust model.
One line, most agents (Claude Code, Codex, Cursor, GitHub Copilot, Amp, and 70+ others — via Vercel's skills CLI):
npx skills add hypawave/skillsPer-platform alternatives:
/plugin marketplace add hypawave/skills
/plugin install hypawave@hypawaveOr standalone: copy dist/standard/hypawave/ into ~/.claude/skills/.
npx skills add hypawave/skills, or point them at dist/standard/hypawave/. codex plugin marketplace add hypawave/skillsEnable hypawave from the Codex app's Plugins view (or in-session: /plugin install hypawave@hypawave). Manifest: .agents/plugins/marketplace.json; the plugin builds to plugins/hypawave/.
.agents/skills/; this repo ships .agents/skills/hypawave/, so cloning it (or copying that folder into ~/.agents/skills/) makes the skill available to Codex without the plugin.hermes skills tap add hypawave/skills then install (Hermes scans the repo-root skills/ directory, which this repo provides at skills/hypawave/).clawhub skill publish dist/clawhub/hypawave.agentskills.io is the open standard (originally Anthropic's), and Claude Code, Cursor, Codex, Gemini CLI, Hermes, GitHub Copilot, and ~40 other tools consume it. So one standard file covers almost everything; only ClawHub uses its own dialect.
| Bundle | Frontmatter | Serves |
|---|---|---|
dist/standard/hypawave/ | agentskills.io standard | Claude Code (standalone), Cursor, Codex, Hermes Skills Hub, Gemini, Copilot, … |
dist/claude/ | same standard skill, wrapped in a plugin | Claude marketplace distribution (.claude-plugin/plugin.json + skills/hypawave/) |
plugins/hypawave/ | same standard skill, native Codex plugin | Codex marketplace distribution (.codex-plugin/plugin.json + skills/hypawave/) |
dist/clawhub/hypawave/ | ClawHub dialect (metadata.openclaw, no license field) | ClawHub only |
There are only two SKILL.md frontmatters (standard + clawhub). Claude and Codex are packagings of the standard skill, not extra frontmatter files.
core/
SKILL.md ← canonical body + shared frontmatter (name, description)
scripts/sign_request.mjs ← secp256k1 signing helper (self-test: --selftest)
variants/
standard/frontmatter.yml ← agentskills.io extras: license, compatibility, metadata
clawhub/frontmatter.yml ← ClawHub extras: version, metadata.openclaw
claude/plugin.json ← Claude plugin manifest (wraps the standard skill)
codex/plugin.json ← Codex plugin manifest (skills: ./skills/)
codex/marketplace.json ← Codex marketplace entry (source, policy, category)
build.mjs · package.json (dep-free) · LICENSE (MIT-0) · README.md · SECURITY.md · CHANGELOG.md
.claude-plugin/marketplace.json ← Claude marketplace (source: ./dist/claude)
.github/workflows/validate.yml ← CI: build + skills-ref validate + signer self-test
dist/ ← generated bundles (do not edit by hand)
skills/hypawave/ ← generated: repo-root path Hermes taps scan
.agents/skills/hypawave/ ← generated: repo-root path Codex scans (bare skill)
plugins/hypawave/ ← generated: native Codex plugin (.codex-plugin/plugin.json + skills/)
.agents/plugins/marketplace.json ← generated: Codex marketplace (source: ./plugins/hypawave)Body + scripts/ are copied verbatim into every bundle — they can't drift. Only the frontmatter + packaging differ. Edit core/, then rebuild.
node build.mjs # → dist/{standard,claude,clawhub}, skills/, .agents/{skills,plugins}, plugins/build.mjs fails fast if name/description violate the agentskills.io constraints, and names every skill directory hypawave (the spec requires the directory name to equal name).
dist/standard/hypawave/. Validate first: npx skills-ref validate dist/standard/hypawave (passes).dist/standard/hypawave/SKILL.md works standalone in ~/.claude/skills/ (also skills-ref-valid). For marketplace distribution, the repo-root .claude-plugin/marketplace.json already lists the plugin (source: ./dist/claude), so users run /plugin marketplace add hypawave/skills. For the public catalog, submit to anthropics/claude-plugins-community (the review runs claude plugin validate + safety screening)..agents/plugins/marketplace.json lists the native plugin (source: ./plugins/hypawave), so users run codex plugin marketplace add hypawave/skills and install from the Codex Plugins view. Validate the bundled skill first: npx skills-ref validate plugins/hypawave/skills/hypawave (passes). (The bare skill also ships under .agents/skills/, covered by the agentskills.io line above.)clawhub skill publish dist/clawhub/hypawave. Do not validate this bundle with skills-ref — ClawHub is a separate format (top-level version, metadata.openclaw) that the agentskills.io validator intentionally rejects; ClawHub validates it at publish time.llms.txt + openapi.json; nothing invented.node core/scripts/sign_request.mjs --selftest).name ≤64 (lowercase/alnum/single-hyphen, matches dir), description ≤1024, license/compatibility/metadata optional; unknown fields tolerated; metadata values are strings.license is not a frontmatter field (registry-wide MIT-0; per-skill overrides unsupported) — omitted. The metadata.openclaw.install block was dropped — the signer's secp256k1 library is vendored, so nothing needs installing. version is semver.platforms field is an OS enum — macos/linux/windows — not agent frameworks, and it accepts base agentskills.io skills).HYPAWAVE_PRIVKEY or ~/.hypawave/identity.json (written once by --gen, shared with the MCP server), which never leaves the machine. The same key is the agent's identity for commerce and waves — back it up; a fresh key is a different agent. The bundled signer is self-contained (secp256k1 is vendored under scripts/vendor/) — it needs only Node 18+, no install.llms.txt and openapi.json at hypawave.com remain authoritative; the skill links to them rather than duplicating the manual.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.