Evidence row 527912

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://api.aiskills402.com/v1/skills/oauth-redirect-flow-review/file"
    ]
  ],
  "name": "OAuth Redirect Flow Review",
  "owner_address": "0x8e37022edcf0f21cf3c9f93fee9d4d32519f36f4",
  "raw": {
    "accepts": [
      {
        "amount": "10000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 60,
        "network": "eip155:8453",
        "payTo": "0x8e37022edcf0f21cf3c9f93fee9d4d32519f36f4",
        "scheme": "exact"
      }
    ],
    "description": "OAuth Redirect Flow Review — Reviews ONE OAuth 2.0 or OpenID Connect sign-in flow written in code for the four mistakes that let an attacker steal a login or a token, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings. It catches a state value that is never compared or not tied to the user's session, a browser or mobile client that sends no PKCE challenge, a redirect address matched by prefix or substring, and an implicit flow …",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "method": "GET",
            "type": "http"
          },
          "output": {
            "example": {
              "file": {
                "content": "<the SKILL.md file>",
                "encoding": "utf-8",
                "name": "SKILL.md"
              },
              "name": "OAuth Redirect Flow Review",
              "ok": true,
              "receipt": {
                "settled": true,
                "tx": "0x<settlement transaction>"
              },
              "redownload": {
                "token": "<64 hex chars>",
                "url": "<api>/v1/purchases/<token>"
              },
              "sha256": "<sha256 of SKILL.md>",
              "skill": "oauth-redirect-flow-review",
              "version": "1.0.0"
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "headers": {
                  "additionalProperties": {
                    "type": "string"
                  },
                  "type": "object"
                },
                "method": {
                  "enum": [
                    "GET",
                    "HEAD"
                  ],
                  "type": "string"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "lastUpdated": "2026-10-27T08:01:45.863Z",
    "quality": {
      "l30DaysTotalCalls": 1,
      "l30DaysUniquePayers": 1,
      "lastCalledAt": "2026-10-27T08:01:45.624Z"
    },
    "resource": "https://api.aiskills402.com/v1/skills/oauth-redirect-flow-review/file",
    "serviceName": "OAuth Redirect Flow Review",
    "tags": [
      "agent-skill",
      "oauth-redirect-flow-review",
      "oauth",
      "oidc",
      "pkce"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "OAuth Redirect Flow Review — Reviews ONE OAuth 2.0 or OpenID Connect sign-in flow written in code for the four mistakes that let an attacker steal a login or a token, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings. It catches a state value that is never compared or not tied to the user's session, a browser or mobile client that sends no PKCE challenge, a redirect address matched by prefix or substring, and an implicit flow …"
}

What the leaf hashes

{"body":"4f527e4df4dd7f5f3de44f5861d7b744f8fe429cdc3daf848f7d3e139f7e58ad","id":527912,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793124871832572,"prev":458237,"subject":"x402_bazaar:https://api.aiskills402.com/v1/skills/oauth-redirect-flow-review/file","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-27 (273461 rows).

1. 0x8c03c9119a926c1cf08abf39c20250b7e34c8cbe68ad72131a93d8d8190913e9
2. 0xdb26b2d14ce54bb59c69e020f56d3e8e18aa0a8fd37d837c8ba69be08c2fd901
3. 0x64ed28a4e90345aa6ea5c2fbd45a9a19966a7d984f082bc48b1aca725efa6028
4. 0x2dc58335ef883cc5235b38ee84e5cb70548724513bed1115dfb7c579de098525
5. 0x5e89c00bf6b9382e30bee936c73676b2368f53cc3bedc4096f8717fe7a5ba1e6
6. 0x79fa822285b2c1d9a1e0604f0d680c065424dc19467850658bfed5eae70b8948
7. 0x0eef1a6a27e9e0bd1546a4f9a499739cab0b02134596b26fe4562308d0275532
8. 0x2d17fdbb287e48783a8cbea7b4a07a63ea600185a83d0ee1fd0f4dd839046a10
9. 0xf5b0db9df355c235f3877fe01bab2fcb9581f5b8030747d6514d96b06fed55b3
10. 0xbcf4901799851c780248ea43fcd37954a5cb4f96c13b3650c352e6d0250e0ab2
11. 0x918cac431c645247ff7c6aab6fcb71f2cad5755647ddf67674f244b28dd2eecc
12. 0xe9b891332733aa3fa69ace7f82b036df13816078968e2c10034f79c2255498d0
13. 0xea3d566bf95ca7a3a7f6de9c4f77180bd8c5ffd160486a27d870e8a2fb6d0b9e
14. 0x06e3b43165f5b3c31d850bc32f20b2e25b844564c4e042c141b9748c26a5a600
15. 0xb4f7223140c8a36cb87a63d77cf617086d9968dc4658f03e102571ebe06e9ed6
16. 0xfecf3d4646dd4984a13dd715499e842c3fde63692336d97394c2bfd8e877ca5d
17. 0xf30fddbf4811226c58e8f0daf36fddd79fc5f1356b592bb1d99a8061ddbabe66
18. 0x2bf8151e5f157dd183b9de6fa00469551932a7a6e3f33a694895000ac9061197
19. 0x9fc354c0ea3efc3f1b6548bb77ea902a50f2c9647647ea61592efce2bd795699

Day root

0xdd77e5e99da32c3f154180d63e3c3e6fe11e896a2c6896412ef6b5c4bcf7e795

Chained

0x23bb4dfd09f55c15ac3962f53578e02c6114d5bfd9bb451cf8794fb6e2817ef4

Published

On Arc Testnet, block 69414147: 0xb2ebd83aafeb765a0ce66e76aefb133ed06606c98038fd56191e2bcd1dcb77b4