[normancomics]

Adds the public PhantomOperator Aeon Skill Pack to the community registry. The pack is MIT licensed, declares no required secrets, is disabled by default, and has passed SkillScan as SAFE. It provides authorized public-exposure and privacy API guidance; paid calls use native USDC on Base via x402.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[Svector-anu]

[ISSUE] capabilities lists only external_api and secrets_required is empty, but the skill signs Base USDC x402 payments (pack skills/phantomoperator/SKILL.md:22) and POSTs user data to an external host. docs/CAPABILITIES.md defines onchain_writes as "holds or proxies a wallet key and can move funds" and writes_external_host as external POST/PUT. Listed this way, --list --no-secrets shows the pack as keyless and operators never see the payment risk. Please declare external_api, writes_external_host, onchain_writes, and name the wallet/key the skill expects.

[Svector-anu]

[ISSUE] license: MIT is not backed by the pack's LICENSE. That file stops at "WITHOUT WARRANTY OF ANY KIND." (pack LICENSE:15) and omits the rest of the disclaimer and the liability clause, so GitHub reports the license as unidentified (NOASSERTION). The publishing checklist asks for a clear license file; please use the standard MIT text.

[Svector-anu]

Verdict: discussion-needed
Five items to resolve before this can merge; the payment-signing one matters most.

Findings (the two catalog ones are mirrored as inline comments; the rest are in the pack repo or the PR itself):

• [ISSUE] normancomics/phantomoperator-aeon-pack skills/phantomoperator/SKILL.md:22 — the skill tells the agent to sign whatever the HTTP 402 response from freysaai.freysa.dev requires and retry. It sets no spend cap, does not compare the amount to the prices it lists (lines 26-30), asks for no operator confirmation, and does not say which wallet or key signs. The remote host alone decides how much USDC an agent with a funded x402 wallet pays per call. Add a per-call and per-day cap, require confirmation above it, and name the key source.
• [ISSUE] catalog/skill-packs.json:149 — capabilities is only external_api and secrets_required is empty, although the skill signs payments and POSTs user data to an external host. Declare writes_external_host and onchain_writes per docs/CAPABILITIES.md.
• [ISSUE] catalog/skill-packs.json:140 — license: MIT is not backed by the pack's LICENSE (pack LICENSE:15 stops at "WITHOUT WARRANTY OF ANY KIND."; GitHub reports it unidentified).
• [ISSUE] PR level — the PR is CONFLICTING (101 commits behind main, 1 ahead) and ci-skill-packs has no run on this head, so only GitGuardian has run. The description says the pack "has passed SkillScan as SAFE", but no result is linked. The pack repo was created minutes before the PR (1 commit, 0 stars), so please link the scan output and rebase.
• [ISSUE] pack skills/phantomoperator/SKILL.md:9 vs :27 — line 9 says never submit passwords, line 27 offers an "optional password k-anonymity range check" without saying what is sent. Emails, wallet addresses and URLs also go to freysaai.freysa.dev, whose ownership is not stated anywhere in the pack, and schemas and prices are read from that host at run time (:32). State what leaves the machine and who operates the host.

Reviewed with the pr-review rubric by reading the PR and the pack repo. Not run: scripts/skill-scan.sh, scripts/validate-pack.sh, and any call to the pack's host.

[aaronjmars]

Following up on @Svector-anu's review: all 5 items are still open, plus a few more so everything can be fixed in one round.

• Spend: the host offers 11 paid operations, up to $25 (retainer), but the skill lists 5 (max $0.50), and SKILL.md:32 takes prices from the host's own openapi.json. Add a hard per-call and per-run cap in the skill and refuse anything above it.
• Disclosure: the pack should say you run the host and receive the payments (0xC5f2...6Cd6).
• Trust boundary: the skill tells the agent to trust the host's MCP endpoint and openapi.json, which can change after listing. Treat their output as data, never instructions.
• Lookups on people: name, email and handle lookups are gated only by a self-claimed "authorized". On unattended runs that needs an operator-set allowlist or confirmation.
• Wallet: name the x402 client and wallet key to use (see the skim and miroshark-matchday packs for the pattern).
• Nit: category is "security" in the catalog and "basics" in the pack.

The conflict is only appends at the end of both files; rebase on main and keep both sides.

[normancomics]

Thanks — all requested items are now addressed and the PR has been rebased on current main with both append-only conflicts preserved.

The external pack update is live:
normancomics/phantomoperator-aeon-pack@2ede0c9

The rebased registry branch is now pushed in this PR. It includes the hard $0.50 per-call/per-run cap, receiver disclosure, untrusted-host boundary, unattended lookup allowlist/confirmation gate, wallet/client requirements, and category alignment.

[Svector-anu]

the pack repo normancomics/phantomoperator-aeon-pack is listed by github as license "other", not MIT as this PR states. please fix the license in the pack repo or the entry here, one or the other.

i could not verify the "SkillScan SAFE" result or the $0.50 x402 spend cap. the pack is disabled by default, which is the right default for an external pack.

requesting changes until the license matches.

[Svector-anu]

update after reading the pack in normancomics/phantomoperator-aeon-pack at 2ede0c9.

1. secrets: the manifest and catalog entry say no secrets are required, but SKILL.md:38 and README.md:11 need AEON_X402_WALLET_PRIVATE_KEY for paid calls, and SKILL.md:44 names PHANTOMOPERATOR_PERSON_LOOKUP_ALLOWLIST. the installer only checks the manifest, so the wallet key is never flagged. secrets_required has to list both.

2. spend cap: the $0.50 per call and per run cap is only in the docs (SKILL.md:21, README.md:11 says "the skill enforces" it). there is no code that enforces it. either add the enforcement or reword the claim.

3. license: the LICENSE file starts with the MIT text but stops before the standard liability clause, so github reads it as "other". add the full text.

4. SkillScan SAFE: no report, hash or link is in the pack or the PR. link the report and the commit it covers, or drop the claim.

5. scope: the metadata-audit and threat-scan steps (SKILL.md:69-70) make external hosts probe third-party urls, and the only gate is the requester's own statement. add an explicit authorization step before those run.

requesting changes until 1, 2 and 3 are fixed. 4 and 5 need an answer before merge.

[aaronjmars]

Thanks for the updates so far. Re-checking the pack repo at current HEAD, a few of the open findings still stand:

1. LICENSE is truncated mid-text - it ends at "AS IS", WITHOUT WARRANTY OF ANY KIND. and GitHub still reports NOASSERTION rather than MIT. Please restore the full MIT text (or update the catalog entry to match whichever license you choose).
2. secrets_required is empty - skills-pack.json lists secrets_required: [] but SKILL.md needs AEON_X402_WALLET_PRIVATE_KEY and PHANTOMOPERATOR_PERSON_LOOKUP_ALLOWLIST. Please populate the field.
3. Unverifiable claims - the $0.50 spend cap and "SkillScan SAFE" exist only in prose. Please link the SkillScan report/hash (or drop the claims in this PR).

Happy to re-review once the pack repo is updated.