hypawave-798fab — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hypawave-798fab (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A portable Agent Skill that teaches autonomous agents to buy and sell over Hypawave's accountless Lightning paths (3a / 3b). One shared core, assembled into platform bundles.
Non-custodial and dependency-free — see SECURITY.md for the trust model.
/plugin marketplace add hypawave/skills
/plugin install hypawave@hypawaveOr use it standalone: copy dist/standard/hypawave/ into ~/.claude/skills/.
dist/standard/hypawave/ (a standard Agent Skill folder)..agents/skills/; this repo ships .agents/skills/hypawave/, so cloning it (or copying that folder into ~/.agents/skills/) makes the skill available to Codex.hermes skills tap add hypawave/skills then install (Hermes scans the repo-root skills/ directory, which this repo provides at skills/hypawave/).clawhub skill publish dist/clawhub/hypawave.agentskills.io is the open standard (originally Anthropic's), and Claude Code, Cursor, Codex, Gemini CLI, Hermes, GitHub Copilot, and ~40 other tools consume it. So one standard file covers almost everything; only ClawHub uses its own dialect.
| Bundle | Frontmatter | Serves |
|---|---|---|
dist/standard/hypawave/ | agentskills.io standard | Claude Code (standalone), Cursor, Codex, Hermes Skills Hub, Gemini, Copilot, … |
dist/claude/ | same standard skill, wrapped in a plugin | Claude marketplace distribution (.claude-plugin/plugin.json + skills/hypawave/) |
dist/clawhub/hypawave/ | ClawHub dialect (metadata.openclaw, no license field) | ClawHub only |
There are only two SKILL.md frontmatters (standard + clawhub). Claude is a packaging of the standard skill, not a third file.
core/
SKILL.md ← canonical body + shared frontmatter (name, description)
scripts/sign_request.mjs ← secp256k1 signing helper (self-test: --selftest)
variants/
standard/frontmatter.yml ← agentskills.io extras: license, compatibility, metadata
clawhub/frontmatter.yml ← ClawHub extras: version, metadata.openclaw
claude/plugin.json ← Claude plugin manifest (wraps the standard skill)
build.mjs · package.json (dep-free) · LICENSE (MIT-0) · README.md · SECURITY.md · CHANGELOG.md
.claude-plugin/marketplace.json ← Claude marketplace (source: ./dist/claude)
.github/workflows/validate.yml ← CI: build + skills-ref validate + signer self-test
dist/ ← generated bundles (do not edit by hand)
skills/hypawave/ ← generated: repo-root path Hermes taps scan
.agents/skills/hypawave/ ← generated: repo-root path Codex scansBody + scripts/ are copied verbatim into every bundle — they can't drift. Only the frontmatter + packaging differ. Edit core/, then rebuild.
node build.mjs # → dist/{standard,claude,clawhub}build.mjs fails fast if name/description violate the agentskills.io constraints, and names every skill directory hypawave (the spec requires the directory name to equal name).
dist/standard/hypawave/. Validate first: npx skills-ref validate dist/standard/hypawave (passes).dist/standard/hypawave/SKILL.md works standalone in ~/.claude/skills/ (also skills-ref-valid). For marketplace distribution, the repo-root .claude-plugin/marketplace.json already lists the plugin (source: ./dist/claude), so users run /plugin marketplace add hypawave/skills. For the public catalog, submit to anthropics/claude-plugins-community (the review runs claude plugin validate + safety screening).clawhub skill publish dist/clawhub/hypawave. Do not validate this bundle with skills-ref — ClawHub is a separate format (top-level version, metadata.openclaw) that the agentskills.io validator intentionally rejects; ClawHub validates it at publish time.llms.txt + openapi.json; nothing invented.node core/scripts/sign_request.mjs --selftest).name ≤64 (lowercase/alnum/single-hyphen, matches dir), description ≤1024, license/compatibility/metadata optional; unknown fields tolerated; metadata values are strings.license is not a frontmatter field (registry-wide MIT-0; per-skill overrides unsupported) — omitted. The metadata.openclaw.install block was dropped — the signer's secp256k1 library is vendored, so nothing needs installing. version is semver.platforms field is an OS enum — macos/linux/windows — not agent frameworks, and it accepts base agentskills.io skills).HYPAWAVE_PRIVKEY, which never leaves the machine. The bundled signer is self-contained (secp256k1 is vendored under scripts/vendor/) — it needs only Node 18+, no install.llms.txt and openapi.json at hypawave.com remain authoritative; the skill links to them rather than duplicating the manual.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.