# Spec72 Lint — Security Certificate (EXAMPLE / sample)

> **EXAMPLE ONLY.** This is a public sample certificate for the OSS skill `xrpl-x402-handoff`. It is **not** a live buyer certificate and does not certify any third-party listing beyond this sample skill.

| Field | Value |
|-------|-------|
| Skill name | `xrpl-x402-handoff` |
| Source | https://spec72.dev/skills/xrpl-x402-handoff/SKILL.md |
| Certificate date | 2026-10-23 |
| Result | **PASS** |
| Scope | Static SKILL.md review (markdown + declared tools/constraints). No runtime sandbox, no live mainnet spend. |
| Auditor | Spec72 (sample deliverable for Lint $29) |
| cert_id | `SAMPLE-2026-10-23-001` |
| verify_url | https://spec72.dev/sample/cert-xrpl-x402-handoff.html |
| Seal | https://spec72.dev/brand/spec72-seal.svg |

---

## OWASP-style checklist summary (agent skill risks)

| Area | Result | One-line note |
|------|--------|---------------|
| Tools / privileged actions | PASS | Spend paths gated; refuses mainnet until explicit human SÍ; no unrestricted shell/tool sprawl in SKILL. |
| Secrets / credential handling | PASS | Explicit ban on requesting seeds; no credential exfil patterns in steps. |
| Exfiltration / data leaving host | PASS | No “send transcript elsewhere” steps; handoff stays human-ops scoped. |
| Handoff clarity | PASS | Hard stop into human ops with spend ceiling + never double-pay rules. |
| When-not-to-use | PASS | Constraints cover refund/legal/seed requests and ambiguous network. |
| Prompt-injection surface | PASS | Treats memos / buyer chat as untrusted for instructions; refuses seed “help”. |

---

## Owners per residual risk (informational; not FAIL)

| Residual | Owner |
|----------|-------|
| Mainnet vs testnet still needs human pin before first sign | Agent ops lead |
| Facilitator 503 after Payment needs evidence packet discipline | Facilitator ops + buyer ops |

---

## Seal

On PASS, Spec72 issues the Spec72 seal + this verifiable cert URL. See `/brand/spec72-seal.svg`.

Related sample Audit (drop-off map + 5 prompts): [AUDIT-xrpl-x402-handoff.md](./AUDIT-xrpl-x402-handoff.md) · [HTML](./)

---

## Disclaimer

Human-reviewed markdown security certificate for a static SKILL.md. **Not a legal warranty**, insurance policy, or guarantee of runtime safety, marketplace acceptance, or zero exploitability. Optional x402 auto-lint (1 USDC Base) is a machine pre-check and is **not** this certificate.

Buy the live product: [Spec72 Lint $29](https://karlsson02.gumroad.com/l/lint) · sample page: https://spec72.dev/sample/cert-xrpl-x402-handoff.html