Evidence row 2634067

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://api.aiskills402.com/v1/skills/oauth-redirect-flow-review/file"
    ]
  ],
  "name": "OAuth Redirect Flow Review",
  "owner_address": "0xbc0dcc70d8b5d85541d86ffc68d988fd59c22e68",
  "raw": {
    "accepts": [
      {
        "amount": "10000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 60,
        "network": "eip155:8453",
        "payTo": "0xbc0dcc70d8b5d85541d86ffc68d988fd59c22e68",
        "scheme": "exact"
      }
    ],
    "description": "OAuth Redirect Flow Review — Reviews ONE OAuth 2.0 or OpenID Connect sign-in flow written in code for the four mistakes that let an attacker steal a login or a token, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings. It catches a state value that is never compared or not tied to the user's session, a browser or mobile client that sends no PKCE challenge, a redirect address matched by prefix or substring, and an implicit flow …",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "method": "GET",
            "type": "http"
          },
          "output": {
            "example": {
              "file": {
                "content": "<the SKILL.md file>",
                "encoding": "utf-8",
                "name": "SKILL.md"
              },
              "name": "OAuth Redirect Flow Review",
              "ok": true,
              "receipt": {
                "settled": true,
                "tx": "0x<settlement transaction>"
              },
              "redownload": {
                "token": "<64 hex chars>",
                "url": "<api>/v1/purchases/<token>"
              },
              "sha256": "<sha256 of SKILL.md>",
              "skill": "oauth-redirect-flow-review",
              "version": "1.0.0"
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "headers": {
                  "additionalProperties": {
                    "type": "string"
                  },
                  "type": "object"
                },
                "method": {
                  "enum": [
                    "GET",
                    "HEAD"
                  ],
                  "type": "string"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "lastUpdated": "2026-11-03T03:05:07.734Z",
    "quality": {
      "l30DaysTotalCalls": 2,
      "l30DaysUniquePayers": 1,
      "lastCalledAt": "2026-11-03T03:05:07.503Z"
    },
    "resource": "https://api.aiskills402.com/v1/skills/oauth-redirect-flow-review/file",
    "serviceName": "OAuth Redirect Flow Review",
    "tags": [
      "agent-skill",
      "oauth-redirect-flow-review",
      "oauth",
      "oidc",
      "pkce"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "OAuth Redirect Flow Review — Reviews ONE OAuth 2.0 or OpenID Connect sign-in flow written in code for the four mistakes that let an attacker steal a login or a token, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings. It catches a state value that is never compared or not tied to the user's session, a browser or mobile client that sends no PKCE challenge, a redirect address matched by prefix or substring, and an implicit flow …"
}

What the leaf hashes

{"body":"d61f955a8be28d4ff6563d2f8586f9e4f3fcdff5a9b4bd10eb2b88a8355bc16b","id":2634067,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793734489047717,"prev":527912,"subject":"x402_bazaar:https://api.aiskills402.com/v1/skills/oauth-redirect-flow-review/file","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-11-03 (425475 rows).

1. 0xa29dce5f9f31e978285cb592ecb5141ced294f773fdc8426daf4778263017521
2. 0xbf12073e923b27cac186982c8d372e9728d8e07179ac7929b118bb17529e3285
3. 0x3418598d8183fe1ff988c330562ca18b7bc472a87aa6a90ba9ff29070b25b179
4. 0xf1ca2f56e76837ad0b69d42527934aacc2598e7f9c43f76f3d7be0363d84cd12
5. 0xfce6c4926fc5d3ee399d9df9b42d5749b83cd39dcf8904eaee84135b3ab1ae29
6. 0x404bba1834a03004c86c679d7a8ed4639a798f61a66a26a8fe1ecc0c00a62a99
7. 0xd62d92116a8e9d824a27454fa96b9e5137129245ea5ac0859746e6ca69b9acde
8. 0x6779349d2703f2ace87b58fdf34f1f0c7ee3ef604b0f24ef7747b29a177f7625
9. 0x42d389eb8c3f914e8c2e075cf867da681e144b32bc425b885064fe61010b420b
10. 0x680004ec522727f2e015859f4b9eb3063ccce092a9f557339c8052a6cf53572d
11. 0xa069bb6f94e5f0566bb68e99e3e4329fcd48a1888cfad8fe127cd6c74c2fcc86
12. 0x18e26c9ce6560a8dfdfac2a5585b2cf9df1ce96dc143db164f777c4bb4b3de47
13. 0xf28d67782c92bef914bcbfba8a09fe25600ef28046c4bb2c25d01c0f921a6c77
14. 0xe49428eac50d81f1f7650588e082bd418a927c143f69fb66decc0ace1ad681d0
15. 0xc8c3351be4f517ca5732d6f5ee3d1d64170b8e4410d31b9c614949031fbc07a0
16. 0xdbc1c0882584cff2eba84dcd18af41b5fd070127c962a21b00db1ec3e352cc94
17. 0x39dab39081985bbfffe23b080399a9d1a9cb9c2c8960102350c4212113cb2cba
18. 0xac5402954216dc6c7020a6405675c8fc3b0828c2ab02943d80de52677a2f1fc3
19. 0x85f3a27c16056a361d9ba33355a575ca7123f86de901b204c88953c4b8ea441a

Day root

0xb646ffa569e24bf8336b0a15a9d98d0a2f1239f58e10c2b18a9d22e43343566a

Chained

0x35e926359fd19031c6b5e08fb3b44f2524386a57c8fdd353336c185603f53d43

Published

On Arc Testnet, block 70601990: 0xa5f9dadba13cde129126b950e64b815e6833cb8ff53b75026c9dbe769c3768c7