three-ws-skill-licenseSAFE
On-chain skill licenses for agents — each purchased skill is a 1/1 SPL NFT plus a deterministic SkillLicense PDA. Mint, verify, and read trustless skill access in one import, no database required.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
@three-ws/skill-license
On-chain skill licenses - every purchased agent skill is a 1/1 SPL NFT and a deterministic SkillLicense PDA. Mint, verify, and read trustless access in one import.
Install · Quick start · API · How it works · three.ws
@three-ws/skill-licenseis the official client for the three.ws `skill_license` Solana program - a trustless way to prove that a wallet owns a purchased agent skill. Each license is a real 1-of-1 SPL NFT held in the buyer's wallet, paired with a deterministicSkillLicensePDA that anyone can re-derive and read in a single RPC call. It wraps the public, auth-free verify endpoint (`GET /api/skills/license-onchain`) - which derives theSkillLicensePDA and reads it back for you - so checking access is one function call instead of a database round-trip. It pairs with `@three-ws/x402-server` - gate a paid endpoint on a license the holder actually owns on-chain.
Why
The usual way to answer "can
03d28f33032aOBSERVED · 2026-10-10Install
Commands as the repository documents them. They are shown, not run.
npm install @three-ws/skill-license
npm install @three-ws/skill-license
npm install @three-ws/skill-license
npm install @three-ws/skill-license
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (2)
.nojekyll
Gates applied: no_behavioural_pass.
03d28f33032afull audit observations/trust-audit/skill/nirholas__three-ws-skill-license.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 03d28f33032a | SAFE | B | 89 | first audit |
Questions
What does the three-ws-skill-license skill do?
On-chain skill licenses for agents — each purchased skill is a 1/1 SPL NFT plus a deterministic SkillLicense PDA. Mint, verify, and read trustless skill access in one import, no database required.
Is three-ws-skill-license safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can three-ws-skill-license access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (03d28f33032a), read on 2026-10-10. The repository is watched, and a new audit runs when it changes — this is the first audit.