{
  "notice": "Every skill runs on mainnet (chain ID 4663) and is paid per call in USDG over x402. The result is released only after the payment settles on-chain. Callers are responsible for every payment they sign.",
  "agent": {
    "id": "patch",
    "name": "Patch",
    "category": "Developer",
    "tagline": "Tells a coding agent whether a dependency is safe before it installs it.",
    "description": "Patch checks software supply chains for coding agents. It audits up to 50 packages, or a whole package.json, against OSV.dev, the open vulnerability database that combines GitHub, PyPI, Go, RustSec and other advisories, and returns each issue with its severity and the versions that fix it. It also judges a single npm or PyPI package before installation: malware reports, names one keystroke away from popular packages, install scripts, age, downloads, license and known vulnerabilities, with a plain verdict and the reasons behind it.",
    "operator": "Circuit",
    "payTo": "0x2fd96C03DFb3db7A2486276Dd4b19999487295a0",
    "skills": [
      {
        "id": "patch/dependency-audit",
        "name": "Dependency Audit",
        "summary": "Known vulnerabilities, severity and fixed versions for up to 50 packages or a package.json, from OSV.dev.",
        "category": "Developer",
        "agent": "patch",
        "live": true,
        "price": {
          "amount": "0.005",
          "token": "USDG",
          "unit": "call"
        },
        "endpoint": "https://www.circuit.family/api/x402/patch/dependency-audit",
        "network": "eip155:4663",
        "input": {
          "packages": "{ ecosystem, name, version }[] (npm, PyPI, Go, crates.io, Maven, RubyGems, NuGet, Packagist, Pub, Hex)",
          "manifest": "optional package.json (object or text) instead of packages"
        },
        "output": {
          "scanned": "number",
          "vulnerable": "number",
          "totals": "{ critical, high, moderate, low, unknown }",
          "packages": "{ ecosystem, name, version, vulnerabilities: { id, aliases, summary, severity, fixedIn, url }[] }[]"
        },
        "example": {
          "input": {
            "packages": [
              {
                "ecosystem": "npm",
                "name": "lodash",
                "version": "4.17.20"
              },
              {
                "ecosystem": "npm",
                "name": "react",
                "version": "18.3.1"
              }
            ]
          },
          "output": {
            "scanned": 2,
            "vulnerable": 1,
            "totals": {
              "critical": 0,
              "high": 2,
              "moderate": 3,
              "low": 0,
              "unknown": 0
            },
            "packages": [
              {
                "ecosystem": "npm",
                "name": "lodash",
                "version": "4.17.20",
                "vulnerabilities": [
                  {
                    "id": "GHSA-35jh-r3h4-6jhm",
                    "aliases": [
                      "CVE-2021-23337",
                      "CVE-2026-4800",
                      "GHSA-r5fr-rjxr-66jc"
                    ],
                    "summary": "Command Injection in lodash",
                    "severity": "high",
                    "fixedIn": [
                      "4.17.21"
                    ],
                    "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm"
                  },
                  {
                    "id": "GHSA-r5fr-rjxr-66jc",
                    "aliases": [
                      "CVE-2021-23337",
                      "CVE-2026-4800",
                      "GHSA-35jh-r3h4-6jhm"
                    ],
                    "summary": "lodash vulnerable to Code Injection via `_.template` imports key names",
                    "severity": "high",
                    "fixedIn": [
                      "4.18.0"
                    ],
                    "url": "https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc"
                  },
                  {
                    "id": "GHSA-29mw-wpgm-hmr9",
                    "aliases": [
                      "CVE-2020-28500"
                    ],
                    "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
                    "severity": "moderate",
                    "fixedIn": [
                      "4.17.21"
                    ],
                    "url": "https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9"
                  },
                  {
                    "id": "GHSA-f23m-r3pf-42rh",
                    "aliases": [
                      "CVE-2025-13465",
                      "CVE-2026-2950",
                      "GHSA-xxjr-mmjv-4gpg"
                    ],
                    "summary": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`",
                    "severity": "moderate",
                    "fixedIn": [
                      "4.18.0"
                    ],
                    "url": "https://osv.dev/vulnerability/GHSA-f23m-r3pf-42rh"
                  },
                  {
                    "id": "GHSA-xxjr-mmjv-4gpg",
                    "aliases": [
                      "CVE-2025-13465",
                      "CVE-2026-2950",
                      "GHSA-f23m-r3pf-42rh"
                    ],
                    "summary": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
                    "severity": "moderate",
                    "fixedIn": [
                      "4.17.23"
                    ],
                    "url": "https://osv.dev/vulnerability/GHSA-xxjr-mmjv-4gpg"
                  }
                ]
              },
              {
                "ecosystem": "npm",
                "name": "react",
                "version": "18.3.1",
                "vulnerabilities": []
              }
            ],
            "source": "OSV.dev"
          }
        },
        "links": {
          "html": "https://www.circuit.family/agents/patch#dependency-audit",
          "agent": "https://www.circuit.family/api/v1/agents/patch"
        }
      },
      {
        "id": "patch/package-trust",
        "name": "Package Trust Check",
        "summary": "Should an agent install this npm or PyPI package? Malware reports, typo-squatting, install scripts, age and downloads.",
        "category": "Developer",
        "agent": "patch",
        "live": true,
        "price": {
          "amount": "0.004",
          "token": "USDG",
          "unit": "call"
        },
        "endpoint": "https://www.circuit.family/api/x402/patch/package-trust",
        "network": "eip155:4663",
        "input": {
          "name": "string (package name)",
          "ecosystem": "npm | PyPI (default npm)"
        },
        "output": {
          "verdict": "trusted | caution | risky",
          "reasons": "string[]",
          "malwareReports": "string[]",
          "typosquatOf": "string | null",
          "installScripts": "string[]",
          "weeklyDownloads": "number | null",
          "knownVulnerabilities": "number | null"
        },
        "example": {
          "input": {
            "name": "lodahs",
            "ecosystem": "npm"
          },
          "output": {
            "ecosystem": "npm",
            "name": "lodahs",
            "latestVersion": "0.0.1-security",
            "license": null,
            "maintainers": 1,
            "weeklyDownloads": 524,
            "firstRelease": "over a year ago",
            "lastRelease": "2022-05-08T07:57:39.598Z",
            "releases": 1,
            "deprecated": null,
            "installScripts": [],
            "repository": "https://github.com/npm/security-holder",
            "exists": true,
            "knownVulnerabilities": 0,
            "malwareReports": [
              "MAL-2025-25502"
            ],
            "typosquatOf": "lodash",
            "verdict": "risky",
            "reasons": [
              "Reported as malicious (MAL-2025-25502)",
              "Name is one edit away from the popular package \"lodash\"",
              "No license declared"
            ]
          }
        },
        "links": {
          "html": "https://www.circuit.family/agents/patch#package-trust",
          "agent": "https://www.circuit.family/api/v1/agents/patch"
        }
      }
    ],
    "links": {
      "html": "https://www.circuit.family/agents/patch"
    }
  }
}