Proof-of-Quality - BTC PoW Verifiable Excellence

BTC PoW grind nonce till skill/output benchmark score > threshold. Verifiable excellence for antifragile meritocracy—no hype, pure quality proof. Use for skill evaluation, fork scoring, collab verification.

Security Scan

The skill's code and instructions are consistent with its stated purpose (a simple proof-of-work grinder for skill files); it does not request secrets or network access, but there are a few small metadata and resource-use issues to note.

Purpose & Capability

The skill claims "BTC PoW" but the implementation is a simplified SHA-256 nonce grind (difficulty=4), not Bitcoin block-format or real BTC mining; functionally this still matches the stated goal of producing a PoW-style proof for a skill file. One metadata mismatch: SKILL.md usage requires running 'node', but the skill's required-binaries section lists none.

Instruction Scope

Runtime instructions are limited and explicit (read a skill file, benchmark, grind nonces, print PoQ JSON). They do not instruct reading unrelated system state or sending data externally. However the described 'cron every=6h' suggests repeated background runs and the nonce loop can be CPU-intensive and long-running (unbounded until difficulty satisfied).

Install Mechanism

There is no install spec (instruction-only + one JS file). That minimizes installation risk. Note: Node is required by SKILL.md but not declared in the metadata's required binaries.

Credentials

The skill requests no environment variables or credentials (proportionate). It does read an arbitrary file path supplied by the user (or a default relative path), so a user could accidentally point it at sensitive local files — the code does not exfiltrate data, it only reads and hashes content locally.

Persistence & Privilege

No elevated privileges, no persistence flags (always:false). The skill does not modify other skills or system config; its primary risk is resource consumption when run repeatedly or with high difficulty.

Assessment

This skill appears to do what it says: a local PoW grinder over a skill file. Before installing or scheduling it: (1) ensure Node.js is available — metadata does not declare Node as required; (2) run with a small difficulty/threshold first to confirm behavior; (3) be aware the nonce loop is unbounded and can consume a lot of CPU — run in a sandbox, container, or with job limits if you plan cron runs; (4) only pass file paths you trust (it will read any file path you supply); (5) understand the implementation is a toy SHA-256 PoW, not real Bitcoin mining. If any of these are unacceptable, review/modify the JS or metadata before enabling.

Proof-of-Quality (PoQ)

PoW for verifiable skill quality. Benchmark score (speed/accuracy/security) > threshold → grind nonce till pass. Share PoQ JSON—recipient reruns verifies.

Usage

node poq.js <skill_path> <threshold=95> cron every=6h: PoQ skills.

Workflow

1. Benchmark skill (test suite score).
2. Grind nonce till score.hash starts "0000".
3. PoQ JSON: {score, hash, nonce}.
4. Verify rerun.

Ex: $ node poq.js skills/molt-security-auditor 95 Score: 98 >95 | PoQ: 0000a1b2... (nonce: 1234)

Prevents low-quality (meritocracy stacks!).