
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
@trustless-work/skill
Advanced tools
AI skill installer and integration verifier for Trustless Work (Escrow-as-a-Service on Stellar)
AI skill installer and integration verifier for Trustless Work — Escrow-as-a-Service on Stellar/Soroban.
.claude/skills/trustless-work/ — automatically available in every Claude Code session without any extra configuration.npx @trustless-work/skill
Follow the interactive prompts.
_____ _ _ _
|_ _| |_(_)_ _ __ _ _ __
| | | '_| | '_/ _` | ' \
|_| |_| |_|_| \__,_|_|_|_|
\_/ |___/
──────────────────────────────────────────────────────
AI Skill Installer & Integration Verifier v1.0.0
Escrow-as-a-Service on Stellar · docs.trustlesswork.com
──────────────────────────────────────────────────────
? Select your AI coding assistant: › Claude Code (Anthropic)
? What would you like to do? › 📦 Install skill
? Choose a product preset: › 🚀 Full stack (API + SDK + Blocks)
✓ SKILL.md
✓ references/api.md
✓ references/sdk.md
✓ references/blocks.md
✓ references/checklist.md
✓ references/examples.md
✓ meta.json written
✅ Installation complete!
Skill installed at: .claude/skills/trustless-work/
Usage: The skill is automatically available in Claude Code. Start a new session to use it.
npx @trustless-work/skill
# → Verify integration
──────────────────────────────────────────────────────────────
🔍 Trustless Work Integration Report
Project: Next.js | 2/20/2026, 10:30:00 AM
──────────────────────────────────────────────────────────────
API (REST)
✅ API key env var found (NEXT_PUBLIC_API_KEY in .env.local)
✅ Auth header handled via TrustlessWorkConfig (SDK)
⚠️ Only development (testnet) API URL found
How to fix: Make the base URL configurable via env var for production
✅ XDR signing pattern detected correctly (sign → submit)
✅ No hardcoded secrets detected
⚠️ No rate limit (429) handling detected
How to fix: Add exponential backoff for 429 responses
SDK (@trustless-work/escrow)
✅ @trustless-work/escrow is in package.json
✅ TrustlessWorkConfig provider found in 1 file(s)
✅ TrustlessWorkConfig is in a "use client" component (Next.js)
✅ useSendTransaction + signTransaction pattern detected
✅ @creit.tech/stellar-wallets-kit is installed
⚠️ engagementId not detected in any file
──────────────────────────────────────────────────────────────
Summary: 7 OK 3 Warnings 0 Failures
⚠️ Integration looks mostly good. Review warnings.
──────────────────────────────────────────────────────────────
Report exported to: .claude/skills/trustless-work/report.md
After running the installer, your project will have:
.claude/
└── skills/
└── trustless-work/
├── SKILL.md ← Core concepts, roles, lifecycle, XDR pattern (auto-loaded by Claude Code)
├── references/
│ ├── api.md ← REST API endpoints, auth, examples
│ ├── sdk.md ← SDK hooks, provider setup, patterns
│ ├── blocks.md ← Blocks components, provider order
│ ├── checklist.md ← Pre-production checklist
│ ├── examples.md ← Full working code examples
│ └── report.md ← Generated after running verify
└── meta.json ← Installation metadata
After installation, the skill is automatically available in every Claude Code session. No additional configuration needed — just start a new session and Claude Code will have Trustless Work context built in.
You can also reference specific files explicitly:
"Help me implement the XDR signing pattern for my escrow"
"Review my integration against the Trustless Work checklist"
"Set up the providers for my Next.js app using the SDK"
# Clone the repo
git clone https://github.com/Trustless-Work/trustless-work-skill
cd trustless-work-skill
# Install dependencies
npm install
# Run tests
npm test
# Test the CLI locally (without publishing)
npm link
# Now run from any directory
cd /path/to/your/project
trustless-work-skill
# Or use node directly
node /path/to/trustless-work-skill/bin/cli.js
# 1. Make sure you're logged in
npm login
# 2. Bump version in package.json
npm version patch # or minor / major
# 3. Publish
npm publish --access public
# 4. Test the published version
npx @trustless-work/skill
bin/
cli.js ← Shebang entry point
src/
index.js ← Main orchestrator
ui/
banner.js ← ASCII banner
menu.js ← Interactive prompts
installers/
claudeCode.js ← Claude Code installer
verifiers/
index.js ← Verifier orchestrator + report export
trustlessApi.js ← REST API checks
trustlessSdk.js ← SDK checks
trustlessBlocks.js ← Blocks checks
utils/
fs.js ← File system utilities
detect.js ← Project detection + file scanning
__tests__/
verify.test.js ← Unit tests
skill/ ← Skill templates (copied to user's project)
SKILL.md ← Main entry point with YAML frontmatter
references/
api.md
sdk.md
blocks.md
checklist.md
examples.md
To add support for OpenCode or Gemini:
src/installers/openCode.js (copy claudeCode.js as template)src/ui/menu.js — remove [coming soon] from the agent optionsrc/index.js — add the new agent's install callskill/references/new-product.mdsrc/verifiers/trustlessNewProduct.jssrc/verifiers/index.js to call the new verifiersrc/installers/claudeCode.js — add the new file to SKILL_FILESsrc/ui/menu.jsMIT
FAQs
AI skill installer and integration verifier for Trustless Work (Escrow-as-a-Service on Stellar)
The npm package @trustless-work/skill receives a total of 12 weekly downloads. As such, @trustless-work/skill popularity was classified as not popular.
We found that @trustless-work/skill demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.