Security audit
Security checks across malware telemetry and agentic risk
This skill performs a disclosed paid notarization workflow that sends hashes and payment/authentication metadata to AOT Trust, which is sensitive but aligned with its stated purpose.
Install only if you are comfortable sending a document-derived hash and authentication/payment metadata to AOT Trust. Use a dedicated low-balance wallet, verify the exact hash, destination, and $0.01 USDC cost before signing, and avoid notarizing sensitive or guessable content where a public hash could reveal linkage.
metadata: author: aotrust version: "3.7.0" mcp-endpoint: https://api.aotrust.link/mcp http-endpoint: https://api.aotrust.link/notarize verification-endpoint: https://api.aotrust.link/v1/pdr/verify near-handle: aotrust
author: aotrust version: "3.7.0" mcp-endpoint: https://api.aotrust.link/mcp http-endpoint: https://api.aotrust.link/notarize verification-endpoint: https://api.aotrust.link/v1/pdr/verify near-handle: aotrust ---
version: "3.7.0" mcp-endpoint: https://api.aotrust.link/mcp http-endpoint: https://api.aotrust.link/notarize verification-endpoint: https://api.aotrust.link/v1/pdr/verify near-handle: aotrust ---
OAuth 2.1 with PKCE (S256). Discovery: - Resource: `https://api.aotrust.link/.well-known/oauth-protected-resource/mcp` - Authorization server: `https://api.aotrust.link/.well-known/oauth-authorization-server` - Register client: `POST https://api.aotrust.link/oauth/register` - Authorize: `GET https://api.aotrust.link/oauth/authorize`
OAuth 2.1 with PKCE (S256). Discovery: - Resource: `https://api.aotrust.link/.well-known/oauth-protected-resource/mcp` - Authorization server: `https://api.aotrust.link/.well-known/oauth-authorization-server` - Register client: `POST https://api.aotrust.link/oauth/register` - Authorize: `GET https://api.aotrust.link/oauth/authorize` - Token: `POST https://api.aotrust.link/oauth/token`
- Resource: `https://api.aotrust.link/.well-known/oauth-protected-resource/mcp` - Authorization server: `https://api.aotrust.link/.well-known/oauth-authorization-server` - Register client: `POST https://api.aotrust.link/oauth/register` - Authorize: `GET https://api.aotrust.link/oauth/authorize` - Token: `POST https://api.aotrust.link/oauth/token`
- Resource: `https://api.aotrust.link/.well-known/oauth-protected-resource/mcp` - Authorization server: `https://api.aotrust.link/.well-known/oauth-authorization-server` - Register client: `POST https://api.aotrust.link/oauth/register` - Authorize: `GET https://api.aotrust.link/oauth/authorize` - Token: `POST https://api.aotrust.link/oauth/token` ### Available Tools (4)
- Authorization server: `https://api.aotrust.link/.well-known/oauth-authorization-server` - Register client: `POST https://api.aotrust.link/oauth/register` - Authorize: `GET https://api.aotrust.link/oauth/authorize` - Token: `POST https://api.aotrust.link/oauth/token` ### Available Tools (4)
x402 payment requires HTTP calls — MCP tool calls alone cannot complete the flow:
1. **MCP:** Call `notary_quote` with `work_hash` (see "Step 1: Compute the Work Hash" below) → get price ($0.01 USDC) and quote details
2. **HTTP:** POST to `https://api.aotrust.link/notarize` with `{"work_hash": "..."}` → get 402 payment requirements (see Step 2 below for format)
3. **HTTP:** Sign EIP-3009 `transferWithAuthorization` with your Ethereum key, then POST to `https://api.aotrust.link/notarize` again with `x-payment` header → get 200 + PDR (see Step 3 below for format)
4. **MCP:** Call `notary_verify` with the `job_id` from step 3 → confirm `anchored`1. **MCP:** Call `notary_quote` with `work_hash` (see "Step 1: Compute the Work Hash" below) → get price ($0.01 USDC) and quote details
2. **HTTP:** POST to `https://api.aotrust.link/notarize` with `{"work_hash": "..."}` → get 402 payment requirements (see Step 2 below for format)
3. **HTTP:** Sign EIP-3009 `transferWithAuthorization` with your Ethereum key, then POST to `https://api.aotrust.link/notarize` again with `x-payment` header → get 200 + PDR (see Step 3 below for format)
4. **MCP:** Call `notary_verify` with the `job_id` from step 3 → confirm `anchored`
> **Note:** `notary_notarize_paid` appears in `tools/list` for discovery but cannot be called via MCP — x402 payment headers are not supported in MCP tool calls. Use HTTP POST `/notarize` for the actual payment step.56/56 vendors flagged this skill as clean.
No suspicious patterns detected.