leadup-api-research-builder — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited leadup-api-research-builder (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Produce a decision-ready integration dossier for a third-party API so LeadUp can integrate it safely on the first try — official docs, auth, limits, pricing, webhooks, env keys, reference code, risks, and a fallback. Plan before code.
Trigger phrases: "integrate API", "add Razorpay", "add WhatsApp", "add Gemini", "add DeepSeek", "add OpenAI", "add Stripe", "API research", "check API docs", "how do I connect <service>", "what does <service>'s API need".
For evaluating an open-source repo/library (not a hosted API) → use leadup-github-repo-researcher.
language, maintained, last release). Prefer official over blog posts.
references/api-research-template.md:auth method, endpoints, rate limits, pricing (with the date checked), webhooks (signature + idempotency), env keys.
recency, what is safe to copy/adapt.
relevance), and a degraded/alternate path if the API is down or over quota.
outline (no code yet unless explicitly asked).
A research dossier following api-research-template.md sections 1–11, ending with: Recommendation (go/no-go + package + integration steps) and the exact .env.example key names to add (placeholders only).
See references/security-rules.md. Most relevant here:
PROVIDER_KEY=__SET_ME__); never request,print, or store real keys/tokens.
numbers as current.
.env.example instead of __SET_ME__.leadup-github-repo-researcher.
guidance, and mark docs/pricing as "verify before integration".
pages to confirm; do not guess pricing/limits.
should land once a project exists.
mode (test vs live), env key names, and webhook URL; do not disable signature checks to "make it pass".
test/live key prefixes, env key names as placeholders, and a fallback.
"verify if stale".
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.