A.I. Cheese

Send paid messages to real humans via the A.I. Cheese platform (aicheese.app). Use when an agent needs human input — surveys, feedback, photo tasks, local kn...

Security Scan

The skill's claimed purpose (paying humans for messages) matches the code, but there are coherence and safety gaps — most notably an undeclared required private key, remote-controlled payment recipients, and the potential for autonomous fund transfers.

Purpose & Capability

The name/description match the code: it searches a directory, requests payment requirements, and sends USDC on Base. However the registry metadata did not declare the sensitive environment variable the runtime actually requires (AGENT_PRIVATE_KEY). The skill legitimately needs a wallet key to pay humans, but the missing declaration is an incoherence in the manifest.

Instruction Scope

SKILL.md and the script instruct the agent to read a private key from AGENT_PRIVATE_KEY, call the remote API, and send on-chain USDC to addresses returned by that API. That scope is consistent with 'paid messaging' but the code trusts the remote server's payTo address without local validation — meaning it will transfer funds to whatever address the server returns. The instructions do not limit or validate recipients or amounts beyond trusting the API response.

Install Mechanism

There is no install spec (instruction-only), which minimizes installer risk. A TypeScript CLI file is bundled and intended to be run via `npx tsx`, which will fetch runtime packages (tsx, ethers) via npm when run; this is a standard but networked dependency fetch rather than a static, pre-verified binary. No downloads from arbitrary URLs or extract operations are present.

Credentials

The runtime requires a wallet private key (AGENT_PRIVATE_KEY) to sign and send USDC transactions — this is proportionate to paying people. But the registry did not list that environment variable or mark it as the primary credential. Requesting a full private key is sensitive: if supplied, the skill can move any assets in that wallet. No unrelated credentials are requested, but the private key exposure is a significant risk unless limited to a dedicated, low-value wallet.

Persistence & Privilege

The skill does not request always:true or system-wide changes, and it doesn't persist itself. However model-invocation is enabled (default), so an autonomous agent could call this skill and cause on-chain payments using the provided private key. Combined with the private-key requirement and remote-controlled payment addresses, that autonomy materially increases risk.

What to consider before installing

This skill does what it says (pay humans for replies) but requires you to provide a wallet private key and it will transfer USDC to addresses the remote API returns. Before installing: (1) Do NOT provide a primary/important wallet private key — use a dedicated, funded test wallet with minimal balance. (2) Confirm the AICHEESE_SERVER URL is legitimate (https://aicheese.app) and check their docs; the server controls the recipient address returned by the API, so a malicious/compromised server could make you pay arbitrary addresses. (3) Prefer an external signer or hardware wallet flow instead of exporting your private key to an env var, or require manual confirmation before any payment. (4) Consider disabling autonomous invocation for agents that hold any private key, and require manual user approval for send operations. (5) Test with very small amounts first and inspect the payTo address returned by the API. (6) Ask the publisher to update the registry metadata to declare AGENT_PRIVATE_KEY (and mark it as a sensitive primary credential) so the manifest matches runtime behavior.

A.I. Cheese — Paid Human Messaging

Send paid messages to real humans. They get USDC, you get answers.

API Base: https://aicheese.app

Quick Start

# Search for humans in London who speak Spanish, max $0.50/msg
npx tsx scripts/ai-cheese.ts search --location london --skills spanish --max-price 0.50

# Send a paid message
npx tsx scripts/ai-cheese.ts send --to <userId> --message "What's the best cafe near you?"

# Check for replies
npx tsx scripts/ai-cheese.ts replies

Setup

Set environment variable with a funded wallet (needs USDC on Base):

export AGENT_PRIVATE_KEY="0x..."

API Reference

Conversations (Threading)

Messages support multi-turn conversations. The first message creates a thread. Follow-ups use the threadId from the response.

Pricing:

• New message → full price
• Follow-up before user replies → full price (no spamming)
• Follow-up after user replies → 25% of base price (min $0.01)
• User replies → free

Flow: Send → get threadId → poll for reply → send follow-up with threadId → repeat.

1. Search Directory

Find humans by location, skills, or price.

GET /api/v1/directory
  ?location=miami
  ?lat=25.76&lng=-80.19&radius=50
  ?skills=photographer,foodie
  ?maxPrice=1.00
  ?limit=20&offset=0

Returns { profiles: [{ id, displayName, bio, location, skills, pricePerMessage }], total }.

2. Send Paid Message (x402 Flow)

POST /api/v1/message
Body: { toUserId, fromAgentId, fromLabel, content }

Flow:

1. First request returns 402 with payment requirements
2. Pay USDC to the user's wallet address (amount in response)
3. Retry with X-Payment: <txHash> header
4. Message delivered, returns { ok: true, messageId, threadId }

For follow-ups, include threadId in the body. Price is reduced to 25% if the user has replied.

3. Poll for Replies

GET /api/v1/agent/replies?agentId=<your-agent-id>&since=<timestamp>

Returns { replies: [{ messageId, replyContent, replyAttachments, replyAt, amountPaid }] }.

Attachments are URLs to uploaded photos (e.g. /api/v1/files/abc.jpg).

4. Register Webhook

Get notified instantly when a user replies:

POST /api/v1/agent/webhook
Body: { agentId, url, secret }

Webhook payload includes X-Webhook-Signature (HMAC-SHA256 of body using secret).

CLI Script

The bundled scripts/ai-cheese.ts handles the full x402 payment flow automatically.

Commands:

• search — Search directory with filters
• send --to <id> --message "..." — Pay and send a message
• replies — Poll for replies to your messages
• webhook --url <url> — Register a webhook

Run with: npx tsx <skill-path>/scripts/ai-cheese.ts <command> [options]

Use Cases

• Surveys — Ask humans about their area, opinions, experiences
• Feedback — Get real user testing on apps, ideas, products
• Photo tasks — Request photos of locations, products, storefronts
• Local knowledge — Find people near a location for ground-truth info
• Verification — Human-in-the-loop checks for AI outputs

Tips

• Start with $0.10-0.25/msg for surveys, $0.50-5.00 for tasks requiring effort
• Filter by location for geo-specific tasks
• Filter by skills for specialized knowledge
• Poll replies every few minutes, or use webhooks for real-time
• Replies can include photos — check replyAttachments