Skill

• Risk level: Low
• Analyzed: Feb 17, 2026, 8:25 AM
• Findings: 0
• Version: 1.2.2

Overview

The skill is internally consistent with a blockchain-security API: it instructs agents to call aegis402.xyz endpoints and does not request unrelated credentials or privileged system access, but it sends transaction metadata to an external service and suggests installing third-party client libraries and a funded agent wallet — review those points before use.

This skill appears to do what it says: it forwards transaction metadata to an external API (https://aegis402.xyz) to evaluate risk. Before installing/using: 1) Understand that transaction details and addresses will be sent to a third-party service — avoid sending private keys or seed phrases (the skill also warns against this). 2) If you follow the SKILL.md to install @x402/* npm packages, inspect those packages (or their source) before installing — npm packages execute code on your machine. 3) Payments require funding an agent-managed wallet — be careful with programmatic wallets and approve only trusted signers. 4) The X-Client-Fingerprint header is used for accounting and can be a cross-request identifier; consider privacy implications. 5) Because the source/homepage are not a widely-known vendor, consider verifying the GitHub repository and domain reputation before using paid features or installing suggested client libraries.