Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently verifies factual claims using a disclosed external service and does not include hidden code, persistence, or privilege escalation.
Before installing, users should understand that factual claims may be sent to a third-party verification service. Use it for public, non-sensitive facts and avoid submitting confidential business information, personal data, secrets, or private/internal claims.
The skill instructs the agent to send user-provided claim text to a third-party verification service but does not require explicit user consent or a warning at the point of transmission. Because claims may contain sensitive business, personal, or contextual information, this can cause unintended data disclosure to an external service even if the feature is meant for legitimate fact-checking.
This line contains a concrete instruction to POST claim contents to an external domain, which creates a direct exfiltration path for user-supplied text. In agent contexts, users may phrase claims with embedded sensitive details, so blindly forwarding them to a remote API can leak confidential information outside the trust boundary.
If no MCP tool is available, call the API:
curl -X POST https://verify.agentutil.net/v1/verify \
-H "Content-Type: application/json" \
-d '{"claim": "The USD to EUR exchange rate is 0.92"}'
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
## Pricing
- **Free tier:** 25 queries/day, no authentication required
- **Paid tier:** unlimited queries via x402 protocol (USDC on Base), $0.004/query
## Agent Discovery
No suspicious patterns detected.