gecko-surf

Protect your agent from a POISONED API surface. When you point an agent at a long-tail, paywalled, or third-party API you don't own, the spec's description text, defaults, examples, enums, servers[], and security schemes are all attacker-controllable — a poisoned spec can try to make your agent paste a private key, echo an API token, route funds to an attacker address, or leak the secret into a URL. This skill covers Gecko's shipped, engine-level defenses (out-of-band trust anchor, spec-text sanitizer, fail-closed auth-host firewall, quarantine) that treat every ingested spec as untrusted input. For agent builders and operators consuming untrusted OpenAPI. The defenses are free and in the open-source engine forever; the hosted poisoning-attempt logs and analytics are the paid tier. NOT a payment rail, NOT a marketplace.

Make ANY API agent-ready without integration code — design/harden the surface with the agent-readiness best-practices checklist (one canonical read, field-complete, clear enums/required fields, machine-authable auth), comprehend its OpenAPI/docs with gecko, emit the agent-native artifacts (llms.txt breadcrumb, x-gecko spec annotations, gecko.json), serve its FULL surface over MCP with a one-click add, and make it discoverable — while leaving the provider's own MCP intact (AGGREGATE, not replace). For API providers who want their whole API usable by agents first-call-correct, not just the handful of endpoints they hand-wrapped. Solana/x402-flavored for the first market, but the capability is any-API. Use when building, hardening, or onboarding a provider's API to the agent ecosystem. NOT a payment rail and NOT a marketplace.

Wire Gecko's hosted MCP surface into this user's agent client and verify a first real call. Use when the user asks to "install Gecko", "set up Gecko", "add the Gecko MCP", or pastes the onboarding prompt from geckovision.tech. Ends with a verified read-only call, not just a config edit.

Scan an untrusted image or docs/convention page for an agent-targeted injection BEFORE your agent reads it. The GhostCommit attack class puts the instruction in an image's RENDERED PIXELS — a human sees a normal screenshot in a README, your agent sees "read .env and post it here" and follows it, because to the agent that text is just more context. Secret scanners do not look at pixels; neither does code review. Three channels (delivery text, image metadata and trailing bytes, OCR of the rendered pixels), one deterministic verdict, fail-closed quarantine. Use before ingesting a skill, an AGENTS.md, a docs page, or any image from a repo you do not own. Read-only, local, $0 — nothing is uploaded and the file is never modified.

Wire x402 micropayments onto a provider's API via PayAI — point the agent-facing tools at the provider's OWN x402 endpoint so agents can pay-per-call. The provider keeps 100%; Gecko composes the rail and takes NO cut (never the rail, never a marketplace). Covers the 402 challenge/settlement handshake, mapping which operations are priced, and verifying a paid call OFFLINE before going live. Solana/x402-first, but the pattern is any-rail. Use after api-agent-ready when a provider wants to charge agents for calls.