Kraken Crypto Signals — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Kraken Crypto Signals (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Pay-per-call crypto market-state data for AI agents, served over the x402 protocol on Base mainnet. An agent calls an endpoint, receives HTTP 402, pays USDC, and gets machine-readable, ECDSA-signed data — no accounts, no API keys.
Live: https://signals.nsgoods.org · Manifest: https://signals.nsgoods.org/.well-known/x402 · OpenAPI: https://signals.nsgoods.org/openapi.json On x402scan: https://www.x402scan.com/server/bcc5723d-17eb-40f2-9e23-c1f2e3387dd2 · Demo (40s): https://youtu.be/k2WhYqK1YvQ
signed_by + signature; recover against the published signer to prove it is authentic and untampered./track-record) lets anyone audit past calls; /history reveals older snapshots with their hashes./backtest replays the live strategy over recent history and returns win-rate + average forward return, so an agent can measure the edge before subscribing./signals/preview for free, then pay per call in USDC on Base.A runnable demo agent lives in examples/quickstart. It calls the FREE /signals/preview endpoint and then prints the decoded x402 402 Payment Required challenge for a paid endpoint — no funds needed. Add a low-balance Base hot-wallet key and the same call auto-pays in USDC on Base.
cd examples/quickstart
npm install
cp .env.example .env # leave WALLET_PRIVATE_KEY empty for the no-funds demo
node agent.jsPaid endpoints: /indicators ($0.005), /signals ($0.01), /regime/changed ($0.02), /history ($0.05), /signals/top ($0.10), /backtest ($0.25) — USDC on Base mainnet (eip155:8453), payTo 0xc87a06DEE4c0E85912296002617120BBfd5EF990.
Starter template (free preview → paid pay-per-call over x402): https://github.com/Nikoble1926/agent-starter-x402
| Path | Cost (USDC) | Description |
|---|---|---|
GET /signals?pair=BTC/USD | $0.01 | Trading signal for one pair (BUY/SELL/HOLD + confidence) |
GET /signals/top | $0.10 | Market scan — strongest BUY/SELL signals across major pairs |
GET /history?limit=20 | $0.05 | Revealed historical signal snapshots (commit-reveal) + verifiable hashes |
GET /regime/changed?since=RISK_ON | $0.02 | Market regime (RISK_ON/RISK_OFF) + whether it changed since you last looked |
GET /backtest?pair=BTC/USD | $0.25 | Walk-forward replay: win-rate + avg forward return per BUY/SELL signal |
| Path | Description |
|---|---|
GET /signals/preview | Free sample — BTC/USD direction only |
GET /track-record | Public tamper-evident hash chain |
GET /.well-known/x402 · GET /openapi.json · GET /health · GET / | Manifest, OpenAPI spec, health, landing page |
Any active Kraken */USD spot pair works via ?pair= (e.g. ETH/USD, SOL/USD, XRP/USD, DOGE/USD).
Every response carries signed_by + signature: an EIP-191 personal_sign over the JSON body (canonical json.dumps(sort_keys=True, separators=(",",":"))) before those two keys are added. Anyone can recover the signing address and confirm it equals the published signer 0x5e63d01d6A266BC17f577B80199a2a07B15053C7 — proving the signal is authentic and untampered, without paying. examples/verify_signature.py does exactly this against the FREE /signals/preview endpoint:
pip install eth_account
python examples/verify_signature.py # -> VERIFIED ✓ recover == signed_by == signerListed on [x402scan](https://www.x402scan.com/server/bcc5723d-17eb-40f2-9e23-c1f2e3387dd2) and the [x402 Bazaar](https://docs.cdp.coinbase.com/x402/bazaar) (CDP Facilitator) — agents can find this API via Bazaar semantic search / merchant lookup for payTo 0xc87a06DEE4c0E85912296002617120BBfd5EF990. Settlement runs through the Coinbase CDP Facilitator.
The mcp/ bridge exposes every endpoint as a tool; paid tools settle USDC on Base automatically per call, and get_signal_preview is free. See mcp/ for setup.
pip install -r requirements.txt
cp .env.example .env # set your PUBLIC Base receiving address
python signals_api.pyOnly your public Base receiving address goes in .env. Never put a private key or seed phrase in this repo.
Educational signals from a multi-timeframe strategy. Not financial advice. /backtest is a recent-window walk-forward replay, not a long-horizon study; past performance does not predict future results.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.