synapse-agentpay-fbe802 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited synapse-agentpay-fbe802 (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill for Synapse Network MCP Server repository work and for generating correct AgentPay integration guidance.
llms.txt, README.md, SECURITY.md, and CONTRIBUTING.md before editing.SYNAPSE_ENV=prod; staging is only for preview/E2E validation.Use this workflow:
discover_services -> invoke_and_pay -> get_receiptFor fixed-price services, pass costUsdc as the exact string from discovery. For token-metered services, use maxCostUsdc as a string cap when needed. Always provide or preserve a stable idempotencyKey.
The MCP server uses only SYNAPSE_AGENT_KEY=agt_xxx. Never add docs, tests, config, or code that asks for owner private keys, seed phrases, owner JWTs, provider secrets, admin credentials, internal service tokens, deposits, withdrawals, refunds, settlement controls, or provider setup permissions.
npm run verify:mcp
npm run ci:quality
npm run smoke:cli
npm pack --dry-runFor production release validation, run prod E2E explicitly with a production Agent Key. Do not add prod live E2E to default CI.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.