Agent Economy Report

Code audits

Skill code audits are no longer commissioned

From 3 September to 19 October 2026 anyone could commission, for US$ 29 per version, an independent static reading of the complete published package of a skill. Since 19 October 2026 audits are not sold: the rated party never pays the Report, and no verdict can be bought or ordered. Audits are made at the Report's own initiative (the most downloaded skills first) and published whatever they say, at /k/<slug>.audit, with a JSON and a badge. All audited skills →

How an audit is made: we download the exact published version of the skill from the ClawHub registry, read every file statically (nothing is executed), and publish what the code does: network destinations, binaries, credentials it reads, wallets, obfuscation, download-and-execute, instructions that try to steer the agent, with file and line for every finding, and a verdict: SAFE, CAUTION or UNSAFE. It does not change the skill's trust tier. The author may respond through the dispute channel, and the response is published with the audit. A new version of the skill invalidates the audit.