cup-cig — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cup-cig (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to retrieve detailed information on Italian public projects and tenders from CUP and CIG codes using open data sources.
IMPORTANT: Always writecurlcommands on a single line. Multi-line\continuation breaks argument parsing in agent environments and will cause errors.
User has a CUP
├─ Project metadata (name, sector, entity, amounts)?
│ └─ OpenCUP API (or web page if no API key)
├─ Financial monitoring / execution status?
│ └─ OpenBDAP OData
└─ Associated tenders (CIG)?
└─ ANAC BDNCP bulk (authoritative CUP↔CIG join)
User has a CIG
├─ Full detail (participants, awards, subcontracts, financials) — any CIG type?
│ └─ ANAC dettaglio-cig → scripts/cig-fetch.sh (requires agent-browser)
├─ Starts with Z (e.g. Z063947806)?
│ └─ Below-threshold direct award → ANAC BDNCP bulk (no live API)
└─ Alphanumeric (e.g. 8874674CA7) — basic tender list / outcomes?
└─ SCP-MIT APIexport OPENCUP_API_CLIENT_ID='...'
export OPENCUP_API_CLIENT_SECRET='...'To verify without printing the values:
[[ -n "${OPENCUP_API_CLIENT_ID:-}" ]] && echo "ID is set" || echo "ERROR: OPENCUP_API_CLIENT_ID not set"
[[ -n "${OPENCUP_API_CLIENT_SECRET:-}" ]] && echo "SECRET is set" || echo "ERROR: OPENCUP_API_CLIENT_SECRET not set"Base URL: https://api.sogei.it/rgs/opencup/o/extServiceApi/v1/opendataes/cup/{CUP} Auth: IBM API headers (x-ibm-client-id, x-ibm-client-secret)
curl -sS -X GET "https://api.sogei.it/rgs/opencup/o/extServiceApi/v1/opendataes/cup/J87G22000360002" -H "x-ibm-client-id: ${OPENCUP_API_CLIENT_ID}" -H "x-ibm-client-secret: ${OPENCUP_API_CLIENT_SECRET}" -H "Accept: application/json" | jq '.results[0]|{cup:.CUP, anno:.ANNO_DECISIONE, stato:.COD_STATO_PROGETTO, soggetto:.DESC_SOGGETTO, settore:.DESC_SETTORE_INTERVENTO, area:.DESC_AREA_INTERVENTO, importo:.IMPORTO_COSTO_PROGETTO, regione:.LOC_REGIONI}'Given a file cups.txt (one CUP per line):
while IFS= read -r cup; do echo "=== $cup ==="; curl -sS -X GET "https://api.sogei.it/rgs/opencup/o/extServiceApi/v1/opendataes/cup/$cup" -H "x-ibm-client-id: ${OPENCUP_API_CLIENT_ID}" -H "x-ibm-client-secret: ${OPENCUP_API_CLIENT_SECRET}" -H "Accept: application/json" | jq '.results[0]|{cup:.CUP, stato:.COD_STATO_PROGETTO, soggetto:.DESC_SOGGETTO, settore:.DESC_SETTORE_INTERVENTO, importo:.IMPORTO_COSTO_PROGETTO}'; done < cups.txtThe project page at https://opencup.gov.it/portale/progetto/-/cup/{CUP} is publicly accessible but returns HTML. Use a browser or a headless fetch tool for scraping.
Base URL: https://bdap-opendata.rgs.mef.gov.it/ODataProxy/MdData('bda1676b-62ab-44b7-8f9a-ca93b8534488@rgs')/DataRows Auth: None Field name for CUP: Cccodice_cup_1267962549
curl -sS "https://bdap-opendata.rgs.mef.gov.it/ODataProxy/MdData('bda1676b-62ab-44b7-8f9a-ca93b8534488@rgs')/DataRows?\$filter=Cccodice_cup_1267962549%20eq%20'H87H21003670005'&\$inlinecount=allpages&\$top=10&\$format=json" | jq '[.d.results[]|{cup:.Cccodice_cup_1267962549, descrizione:.Ccdescrizione_cu902475141, stato:.Ccdescrizione_s1176782119, ente:.Ccdescrizione_ti177583083, settore:.Ccsettore_inter1475973826, costo:.Cccosto_lavori_e582037416}]'curl -sS "https://bdap-opendata.rgs.mef.gov.it/ODataProxy/MdData('bda1676b-62ab-44b7-8f9a-ca93b8534488@rgs')/DataRows?\$filter=Cccodice_fiscal1934873127%20eq%20'02246660985'&\$inlinecount=allpages&\$top=10&\$format=json" | jq '[.d.results[]|{cup:.Cccodice_cup_1267962549, ente:.Ccdescrizione_ti177583083, stato:.Ccdescrizione_s1176782119}]'| What | Filter |
|---|---|
| By CUP | $filter=Cccodice_cup_1267962549 eq '{CUP}' |
| By fiscal code | $filter=Cccodice_fiscal1934873127 eq '{CF}' |
| Active projects | $filter=Cccodice_stato_1426672593 eq 'A' |
| Closed projects | $filter=Cccodice_stato_1426672593 eq 'C' |
| By sector | $filter=Ccsettore_inter1475973826 eq 'STRADALI' |
Combine with and/or. Always add $inlinecount=allpages for total counts.
Base URL: https://www.serviziocontrattipubblici.it/WSConsultBandi/rest/ Method: POST + Content-Type: application/x-www-form-urlencoded Note: Use -k flag to skip SSL verification (self-signed certificate). Important: page_limit and offset go as URL query params; all other filters go in the form body. `stato` values: 1=In corso, 2=Scaduti, 3=Tutti. Use 3 when searching by CIG to avoid missing results.
curl -sSkX POST "https://www.serviziocontrattipubblici.it/WSConsultBandi/rest/Bandi/Lista?page_limit=10&offset=0" -H "Content-Type: application/x-www-form-urlencoded" -d "stato=3&cig=8874674CA7" | jq '.'curl -sSkX POST "https://www.serviziocontrattipubblici.it/WSConsultBandi/rest/Esiti/Lista?page_limit=10&offset=0" -H "Content-Type: application/x-www-form-urlencoded" -d "stato=3&cig=8874674CA7" | jq '.'Note: Z-prefix CIG (below-threshold direct awards) appear in Esiti, not in Bandi. Try both endpoints when a CIG returns no results in one of them.
Dataset pages:
https://dati.anticorruzione.it/opendata/dataset/cighttps://dati.anticorruzione.it/opendata/dataset/cupAccess: Bulk CSV/JSON download (no live API — WAF blocks programmatic queries). Live API: Not available.
duckdb -c "DESCRIBE SELECT * FROM read_csv_auto('cup.csv', HEADER=TRUE) LIMIT 1;"
duckdb -c "SELECT * FROM read_csv_auto('cup.csv', HEADER=TRUE) WHERE cig = 'Z063947806' LIMIT 10;"cup column.cig column.Portal: https://dettaglio-cig.anticorruzione.it/cig/{CIG} Method: Browser automation via scripts/cig-fetch.sh Requires: agent-browser, jq Coverage: All CIG types (Z-prefix and alphanumeric). Returns 20+ sections.
The payload is far richer than SCP-MIT: includes bando, stazioneAppaltante, partecipanti, incaricati, aggiudicazione, quadroEconomico, subappalti, varianti, categorieOpera, pubblicazioni, and more.
bash scripts/cig-fetch.sh 8874674CA7
# → ./8874674CA7.jsonbash scripts/cig-fetch.sh 8874674CA7 /tmp
# → /tmp/8874674CA7.jsonIf the script fails with Invalid response: EOF:
agent-browser closeThen rerun the script.
A task is complete when:
jq to format.| Error | Cause | Fix |
|---|---|---|
401 Unauthorized on OpenCUP | Wrong credentials or not set | Check OPENCUP_API_CLIENT_ID/SECRET |
| Empty results on OpenBDAP | CUP not in MOP dataset | Project may not have financial monitoring data |
| No results on SCP-MIT | Z-prefix CIG | Use ANAC BDNCP bulk instead |
| SSL error on SCP-MIT | Self-signed certificate | Add -k flag to curl |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.