uniple-x402-purchase — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited uniple-x402-purchase (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when the user wants an AI agent to buy products from Uniple x402-enabled merchant plugins such as EC-CUBE4, EC-CUBE2, WooCommerce, or Shopify.
Do not use the JPYC EC /api/v1/checkout flow for Uniple merchants.
Uniple flow:
GET /api/x402/shop/eccube/products?merchantSiteId=<domain-or-site-id>products[].GET product.paymentUrl with quantity and shipping* query params.402 with a JSON paymentRequired body andWWW-Authenticate: PaymentRequired ....
TransferWithAuthorization.X-PAYMENT: <base64url paymentPayload>.status: "paid" and webhook delivery details.JPYC EC flow is different:
POST /api/v1/checkoutPAYMENT-SIGNATUREreservation_idDo not mix these protocols.
Always quote before purchasing.
For EC-CUBE4 smoke testing:
merchantSiteId=eccube4.uniple.io
quantity=1
shippingName=テスト 太郎
shippingPostalCode=1000001
shippingPrefecture=東京都
shippingAddress1=千代田区千代田1-1
shippingAddress2=テストビル101
shippingPhone=0312345678
[email protected]Expected current behavior for the 55 JPYC EC-CUBE4 item:
quoteSource: "eccube4"eip155:137Quote can expire. Re-quote immediately before signing.
Before calling any signing or purchase tool, show the user:
Only proceed when the user explicitly says to purchase.
Use max_amount_atomic when purchasing. It is the JPYC amount in 18 decimals.
Examples:
205000000000000000000300000000000000000000If the quote exceeds the cap, stop.
Shipping fields are passed through query params and also appear in paymentRequired.extra.shipping.
Required fields for physical products:
shippingNameshippingPostalCodeshippingPrefectureshippingAddress1shippingPhoneshippingEmailshippingAddress2 is optional.
The included MCP server exposes:
list_productsquote_productpurchase_productlist_products and quote_product do not require a private key. purchase_product requires BUYER_PRIVATE_KEY.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.