Your agent trusts the name.
Attackers change the bytes.
Sterish audits AI agent skills and writes the verdict on chain, pinned to the hash of the exact files it read. Anyone can check a specific version before installing it, without taking the publisher’s word for anything.
Stellar testnet. Real transactions, no mainnet funds.
The problem
Tool poisoning is an attack class, not a hypothetical
An agent skill is instructions the model will follow, handed over with the agent’s own authority. Nothing in the format carries provenance, and nothing checks that what you approved is what later runs. Two published advisories show both halves of that going wrong.
CVE-2025-54136CVSS 8.8
“MCPoison” · Cursor IDE
Approval was remembered under an MCP entry's name. An attacker could commit a harmless config, wait for a developer to approve it, then swap the command it ran — with no new prompt. Patched in Cursor 1.3.
CVE-2025-6514CVSS 9.6
mcp-remote · 437,000+ downloads
OS command injection in versions 0.0.5 to 0.1.15: the first documented case of full remote code execution on a client machine caused by connecting to an untrusted MCP server.
The first one is the whole argument. Approval was bound to a name. Sterish binds the verdict to a content hash, so a changed byte is a different skill and carries no badge.
Meanwhile the skills an agent installs today arrive with no security signal at all — no audit, no provenance, nothing between reading a README and running it.
How it works
Register, audit, verdict, pay, use
01
Register
A publisher registers a skill version against the sha256 of its files. The Registry contract refuses a hash it has already seen.
02
Audit, three stages
Structural checks, then declared-versus-actual static analysis, then an LLM pass over the prose an agent would obey. Each stage can only make the verdict worse.
03
Verdict on chain
Safe, Warning, Dangerous or Unaudited, plus a trust score, written to the Registry against that hash. Only Safe mints a VERIFIED badge.
04
Pay per use
An agent calling a paid skill gets HTTP 402, pays in USDC over x402, and a soulbound licence token is minted to its address.
05
Use
The next request carries proof of that licence and returns 200. No account, no subscription, no human in the loop.
Why Stellar
Three properties, one sentence
A verdict written on chain and pinned to the content hash cannot be forged, a slashable USDC bond keeps auditors honest, and x402 lets an agent pay per use with no account.
Pinned to bytes
The badge belongs to a hash, not to a name or a publisher. Change one byte and the hash changes completely, so the new version starts again at Unaudited.
Auditors have money at risk
An auditor locks a USDC bond in escrow before the audit. A verdict shown to be wrong is slashed to whoever reported it, settled by the contract rather than by us.
Machine-native payment
x402 turns HTTP 402 into a usable payment step. The agent pays in USDC, receives a soulbound licence, and continues — no signup, no card, no human.
Evidence
What is on chain right now
Check a skill before your agent runs it.
The verification API is public and needs no key. Ask by hash if you want a security answer — asking by name trusts the name.
Instawards by @StellarOrg. Sterish is an audit registry for agent skills — not an official Stellar product, and not an app store.