{"id":"ship:0480ad03-eb11-4bc6-a19c-7da29d07223b","withdrawn":false,"project":{"slug":"phylax","name":"Phylax","url":"https://heyresearch.xyz/project/phylax"},"domain":"build","claimType":"GITHUB_RELEASE","summary":"v0.1.0 — Phylax public launch","sourceType":"github","sourceUrl":"https://github.com/usephylax/phylax-skill-audit/releases/tag/v0.1.0","publishedAt":"2026-06-22T13:23:38.000Z","detectedAt":"2026-09-01T20:25:20.798Z","precision":"EXACT","verification":"PUBLICLY_VERIFIED","countsAsBuilding":true,"recordedAt":"2026-09-01T20:25:20.798Z","metadata":{"summary":"First public release of **Phylax** — a pre-install security audit for agent skills on Base (chain 8453). Phylax scans a skill **before** you install it and returns a deterministic `ALLOW` / `WARN` / `DENY` verdict with line-level evidence. ## What it does - **Static scan** — prompt-injection, secret-exfiltration, and obfuscation in `SKILL.md` + manifest - **Onchain scan** — referenced Base contracts: bytecode selectors, proxy/upgradeability, honeypot/owner powers - **Endpoint scan** — x402 endpoints: HTTPS enforcement, 402 schema, price sanity - **Deterministic scoring** — `score = 100 − Σ(sev","releaseVersion":"v0.1.0","prerelease":false},"sources":[{"evidenceRowId":"65de99e1-367e-4e56-aee6-a069077aff12","sourceType":"GITHUB_REPO","sourceUrl":"https://github.com/usephylax/phylax-skill-audit/releases/tag/v0.1.0","observedAt":"2026-09-01T20:25:20.801Z","metadata":{"tag":"v0.1.0","prerelease":false}}],"disclaimer":"Public, source-backed activity HEY recorded. Still Building means verified activity through a tracked market drawdown — it is not a prediction, not a ranking by price, and not investment advice. Few projects meet Still Building or Under the Radar at any time; both are strict by design, and list responses carry the counts."}