Dev Glue

JSON transformation, schema validation, text diffing, document conversion. Four developer utility micro-services. Use for data transformation, validation, an...

Security Scan

The skill documents four paid micro‑services that match its description, but it omits critical operational details (service host, authentication, source/homepage) and implies payments — this mismatch is suspicious and risks unintended data exfiltration or charges.

Purpose & Capability

The name/description (JSON transform, validation, diff, conversion) aligns with the listed endpoints and example request/response payloads. However the SKILL.md references a payment model (x402 / USDC on Base) and paths (/x402s/...) without providing a host, API endpoint base URL, or any information about required credentials, which is inconsistent with a usable service description.

Instruction Scope

The instructions tell the agent to POST data to external endpoints (/x402s/...), implying network calls and payment. They do not specify a hostname, authentication method, or whether data is stored. That means the agent (or user) would be asked to send potentially sensitive JSON/text to an unspecified external service for a fee — a clear scope and privacy concern.

Install Mechanism

No install spec and no code files are present; this instruction-only skill does not write code to disk or install third-party packages, which minimizes local install risk.

Credentials

The skill declares no required environment variables or credentials. That is inconsistent with its payment model: a paid crypto-based API typically requires keys or a wallet; the absence of declared credentials is an unexplained omission and could indicate incomplete metadata or hidden requirements.

Persistence & Privilege

The skill does not request always:true or elevated persistence. Default autonomous invocation is allowed (platform default) but does not by itself increase concern. Combined with external paid endpoints, autonomous invocation could increase risk, but no direct privilege escalation is requested here.

What to consider before installing

This skill describes four paid micro‑services but omits the service host, source/homepage, privacy/storage policy, and any authentication details. Before installing or using it, ask the provider for: (1) the base URL(s) and TLS/hosting proof (e.g., official domain/GitHub repo), (2) authentication and billing flow (how USDC on Base payment is authorized and which keys/wallets are required), (3) data retention/privacy policy (is your JSON/text stored or logged?), and (4) an explicit API key/credential requirement declared in the skill metadata. Until those are provided, avoid sending sensitive data or enabling autonomous use — the current metadata is insufficient to trust where your data would go or how payments would be handled.

Four utility services for data transformation and validation.

Services

/transform-json — JSON Transformation

Apply expressions to transform JSON data.

POST /x402s/transform-json
Body: {"input": {"users": [...]}, "expression": "users[0].name"}
Response: {"output": "Alice", "expression": "users[0].name"}
Price: $0.001 USDC

/validate-json — Schema Validation

Validate JSON against schema with human-readable errors.

POST /x402s/validate-json
Body: {"input": {...}, "schema": {...}}
Response: {"valid": false, "errors": [{"path": ["name"], "message": "required", "rule": "required"}]}
Price: $0.001 USDC

/compare-text — Text Diff

Semantic diff between two texts with similarity score.

POST /x402s/compare-text
Body: {"text1": "Hello world", "text2": "Hello there world"}
Response: {"similarity": 0.647, "additions": 6, "deletions": 0, "diffs": [...]}
Price: $0.001 USDC

/convert-doc — Format Conversion

Markdown to HTML to plain text.

POST /x402s/convert-doc
Body: {"input": "# Hello\n**bold**", "from_format": "markdown", "to_format": "html"}
Response: {"output": "<h1>Hello</h1><p><strong>bold</strong></p>"}
Price: $0.002 USDC

Payment

x402 protocol — USDC on Base.