# Send ShieldAPI Security Intelligence to your agent Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually. ## Fast path - Download the package from Yavira. - Extract it into a folder your agent can access. - Paste one of the prompts below and point your agent at the extracted folder. ## Suggested prompts ### New install ```text I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete. ``` ### Upgrade existing ```text I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run. ``` ## Machine-readable fields ```json { "schemaVersion": "1.0", "item": { "slug": "shieldapi", "name": "ShieldAPI Security Intelligence", "source": "tencent", "type": "skill", "category": "开发工具", "sourceUrl": "https://clawhub.ai/alberthild/shieldapi", "canonicalUrl": "https://clawhub.ai/alberthild/shieldapi", "targetPlatform": "OpenClaw" }, "install": { "downloadUrl": "/downloads/shieldapi", "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=shieldapi", "sourcePlatform": "tencent", "targetPlatform": "OpenClaw", "packageFormat": "ZIP package", "primaryDoc": "SKILL.md", "includedAssets": [ "SKILL.md" ], "downloadMode": "redirect", "sourceHealth": { "source": "tencent", "slug": "shieldapi", "status": "healthy", "reason": "direct_download_ok", "recommendedAction": "download", "checkedAt": "2026-05-08T19:12:28.046Z", "expiresAt": "2026-05-15T19:12:28.046Z", "httpStatus": 200, "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=shieldapi", "contentType": "application/zip", "probeMethod": "head", "details": { "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=shieldapi", "contentDisposition": "attachment; filename=\"shieldapi-3.0.3.zip\"", "redirectLocation": null, "bodySnippet": null, "slug": "shieldapi" }, "scope": "item", "summary": "Item download looks usable.", "detail": "Yavira can redirect you to the upstream package for this item.", "primaryActionLabel": "Download for OpenClaw", "primaryActionHref": "/downloads/shieldapi" }, "validation": { "installChecklist": [ "Use the Yavira download entry.", "Review SKILL.md after the package is downloaded.", "Confirm the extracted package contains the expected setup assets." ], "postInstallChecks": [ "Confirm the extracted package includes the expected docs or setup files.", "Validate the skill or prompts are available in your target agent workspace.", "Capture any manual follow-up steps the agent could not complete." ] } }, "links": { "detailUrl": "https://openagent3.xyz/skills/shieldapi", "downloadUrl": "https://openagent3.xyz/downloads/shieldapi", "agentUrl": "https://openagent3.xyz/skills/shieldapi/agent", "manifestUrl": "https://openagent3.xyz/skills/shieldapi/agent.json", "briefUrl": "https://openagent3.xyz/skills/shieldapi/agent.md" } } ``` ## Documentation ### 🛡️ ShieldAPI — Security Intelligence for AI Agents ShieldAPI is a pay-per-request Security Intelligence Service built on the x402 protocol (HTTP 402 Payment Required). It lets any AI agent perform comprehensive security checks — without accounts, API keys, or subscriptions. Just call, pay, get results. Payments are settled in USDC on Base Sepolia. All endpoints support free demo mode. Base URL: https://shield.vainplex.dev/api Health/Discovery: GET /api/health (free, lists all endpoints + prices) ### 1. check-password — Password Breach Check Checks a full SHA1 hash against 900M+ leaked passwords (HIBP Pwned Passwords). Cost: 0.001 USDC Request: GET /api/check-password?hash=<40-char-sha1> Returns: { found: true/false, count: 3861493 } ### 2. check-password-range — k-Anonymity Range Lookup Returns all matching hash suffixes for a 5-char prefix (privacy-preserving). Cost: 0.001 USDC Request: GET /api/check-password-range?prefix=<5-char-sha1-prefix> Returns: { prefix, total_matches, results: [{ suffix, count }] } ### 3. check-domain — Domain Reputation Checks DNS records, SPF/DMARC, SSL certificate, and queries Spamhaus/SpamCop/SORBS blacklists. Cost: 0.003 USDC Request: GET /api/check-domain?domain= Returns: { domain, dns, blacklists, ssl, risk_score, risk_level } ### 4. check-ip — IP Reputation Checks IPv4 against 4 blacklists, detects Tor exit nodes, resolves reverse DNS. Cost: 0.002 USDC Request: GET /api/check-ip?ip= Returns: { ip, blacklists, is_tor_exit, reverse_dns, risk_score, risk_level } ### 5. check-email — Email Breach Exposure Checks which data breaches affected the email's domain. Returns breach details, exposed data types, and risk recommendations. Cost: 0.005 USDC Request: GET /api/check-email?email= Returns: { breaches: [...], domain_breach_count, risk_score, risk_level, recommendations } Example: test@linkedin.com → 3 breaches (2012: 164M accounts, 2021 scrape: 125M, 2023 scrape: 19M) ### 6. check-url — URL Safety & Phishing Detection Checks URL against URLhaus malware database, runs heuristic analysis (brand impersonation, suspicious TLDs, redirect chains), and probes HTTP. Cost: 0.003 USDC Request: GET /api/check-url?url= Returns: { url, checks: { urlhaus, heuristics, http }, threats, risk_score, risk_level } Detects: Malware distribution, brand impersonation (PayPal, Google, etc.), suspicious TLDs (.tk, .ml), excessive subdomains, login path keywords ### 7. full-scan — Combined Security Scan Runs all applicable checks in parallel. Pass any combination of inputs. Cost: 0.01 USDC Request: GET /api/full-scan?email=&password_hash=&domain=&ip=&url= Returns: Combined results with overall risk score and human-readable summary Example: ?email=test@linkedin.com&password_hash=5BAA61... → "⚠️ Password found in 52M breaches, ⚠️ Domain affected by 3 breaches" ### Demo Mode All 7 endpoints support ?demo=true — returns realistic fake data, no payment required. Perfect for testing your integration before going live. # Try it now: curl -s "https://shield.vainplex.dev/api/check-url?demo=true" curl -s "https://shield.vainplex.dev/api/full-scan?demo=true" curl -s "https://shield.vainplex.dev/api/check-email?demo=true" ### x402 Payment Flow When you call any paid endpoint without payment, ShieldAPI returns HTTP 402 with machine-readable payment instructions: { "x402Version": 1, "error": "X-PAYMENT header is required", "accepts": [{ "scheme": "exact", "network": "base-sepolia", "maxAmountRequired": "3000", "asset": "0x036CbD53842c5426634e7929541eC2318f3dCF7e", "payTo": "0x...", "resource": "https://shield.vainplex.dev/api/check-domain?domain=example.com", "description": "Domain reputation & security check" }] } An x402-enabled client (using @coinbase/x402, @x402/core, or any x402 library) will: Read the 402 response Sign a USDC payment on Base Sepolia Retry with X-PAYMENT header Receive the security check results ### Use Cases Password rotation agents — Check if proposed passwords are in breach databases before setting them Email onboarding — Verify new user emails aren't from heavily breached domains URL safety gates — Screen links before agents click or users visit them IP allowlisting — Verify IPs aren't Tor exits, proxies, or blacklisted Security audits — Full-scan an organization's domain, IPs, and common passwords in one call ### Source & Links Live API: https://shield.vainplex.dev/api/health Source: https://github.com/alberthild/shieldapi (coming soon) Protocol: https://x402.org Data: HIBP (CC-BY), PhishTank, URLhaus (abuse.ch), Spamhaus ## Trust - Source: tencent - Verification: Indexed source record - Publisher: alberthild - Version: 0.2.0 ## Source health - Status: healthy - Item download looks usable. - Yavira can redirect you to the upstream package for this item. - Health scope: item - Reason: direct_download_ok - Checked at: 2026-05-08T19:12:28.046Z - Expires at: 2026-05-15T19:12:28.046Z - Recommended action: Download for OpenClaw ## Links - [Detail page](https://openagent3.xyz/skills/shieldapi) - [Send to Agent page](https://openagent3.xyz/skills/shieldapi/agent) - [JSON manifest](https://openagent3.xyz/skills/shieldapi/agent.json) - [Markdown brief](https://openagent3.xyz/skills/shieldapi/agent.md) - [Download page](https://openagent3.xyz/downloads/shieldapi)