Community skill pack listing: sparkleware (proof-of-loadout, aeon-pulse, eth-gas-watch)

[sparkleware]

What

Lists three sparkleware community skill packs — one README table row each plus matching catalog/skill-packs.json entries.

Why

These are re-submissions, rebuilt to the current bar after the #600 prune. Every criticism from #600 is addressed, plus the conventions that landed since:

• ./notify — every skill notifies through ./notify, never a channel API.

• mode: read-only on all three skills — none of them mutate the repo (their writes go to output/ and memory/, which the read-only guard preserves).

• Network note per docs(skills): kill the "sandbox blocks the network" myth (Sandbox note → Network note) #692 — curl is the primary path everywhere; WebFetch only as the flaky-GET fallback; the one optional secret (ETHERSCAN_API_KEY) routes through ./secretcurl with an {ENV_NAME} placeholder, never a bare command-line interpolation.

• category: on every skill (dev / dev / crypto), alongside tags:.

• capabilities declared per skill in each skills-pack.json (locked taxonomy) and mirrored pack-level in the catalog entries; secrets_required / secrets_optional declared.

• Not thin — only three of the old seven come back:

  • proof-of-loadout — composes an Aeon loadout for a goal from the Sparkleware registry, cross-refs the priced-rail index to flag packs that settle real USDC per call, routes a Charon policy gate (CharonAI-code/charon, from this catalog) in front of them, and preflights a MiroShark market simulation. Plan-only by default: the $1 x402 run needs MIROSHARK_PAY=1 and an X402_CMD and never fires on its own.
  • aeon-pulse — a four-endpoint daily digest of this repo's upstream activity (commits, release freshness, open issues), keyless and inside the anonymous rate limit.
  • eth-gas-watch — Etherscan gas oracle every 4h with traffic-light classification against a configurable threshold, plus a trend line computed from its own grep-able ledger, so its signal compounds the longer it runs.

  hn-top, morning-briefing, registry-watch, and demo-pack are deliberately not resubmitted.

bin/install-skill-pack sparkleware/proof-of-loadout
bin/install-skill-pack sparkleware/aeon-pulse
bin/install-skill-pack sparkleware/eth-gas-watch

Type of change

• Community skill pack listing

Checklist

• Pack repo is public with a clear license (MIT / Apache-2.0) — MIT, all three
• Pack has a skills-pack.json manifest at its root and a SKILL.md per skill
• Write / onchain / bet skills are default_enabled: false — proof-of-loadout (the only pack with a paid, onchain-adjacent path) is default_enabled: false, and its paid run is additionally double-gated behind MIROSHARK_PAY=1 + X402_CMD; aeon-pulse and eth-gas-watch are read-only
• This PR adds both a README table row and a matching skill-packs.json entry (three of each)
• No monkey-patching of Aeon internals; no private or auth-walled endpoints required to run — all endpoints are public; ETHERSCAN_API_KEY is optional

Validated locally against scripts/validate-pack.sh's structural invariants (valid manifest, clean slugs, per-skill SKILL.md present, locked-taxonomy capabilities, license + recommended fields) — 0 errors, 0 warnings on all three.

🤖 Generated with Claude Code

[imancipate]

Triage: ACCEPTED — clean against the contribution rubric (scope ✓ / format ✓ / originality ✓ / size ✓).
Thanks @sparkleware. A maintainer review pass will follow; in the meantime no changes requested from this triage layer.

[aaronjmars]

Maintainer review pass. I verified the claims live rather than reading the description — cloned all three packs, ran validate-pack.sh on each, ran validate-skill-packs.mjs on the merge ref, and hit every endpoint. Summary: the registry side is clean and the convention work from #600 is genuinely done, but one pack can't currently do the thing it exists to do, so I can't land the diff as-is.

Blocker — eth-gas-watch queries a retired endpoint

skills/gas-status/SKILL.md:36 points at Etherscan API V1:

$ curl "https://api.etherscan.io/api?module=gastracker&action=gasoracle"
{"status":"0","message":"NOTOK","result":"You are using a deprecated V1 endpoint, switch to Etherscan API V2 ..."}

Same response with an apikey — V1 is retired for everyone, not just keyless callers.

Tracing your own control flow: line 60's [ "$STATUS" != "1" ] is always true → STATUS_DEGRADED, SAFE/STD/FAST all become "?" → line 82 emits ⚪ unavailable. So every scheduled run, every 4 hours, notifies "unavailable" and appends a std=? row to the ledger — which also starves the Step-3.5 trend line, the part of this pack I actually liked. The documented WebFetch fallback (lines 56, 61) retries the same dead URL, so it can't recover.

One-line fix, V2 works keyless and the response shape is unchanged:

$ curl "https://api.etherscan.io/v2/api?chainid=1&module=gastracker&action=gasoracle"
{"status":"1","message":"OK-Missing/Invalid API Key, rate limit of 1/5sec applied",
 "result":{"SafeGasPrice":"0.149456334","ProposeGasPrice":"0.149707027","FastGasPrice":"0.169901967",...}}

Only URL= needs editing. Note the README claim "no key required for basic use" is true of V2 and false of the URL shipped.

Two things I want your answer on before merging

1. mode: read-only alongside onchain_writes on proof-of-loadout. Line 203 argues mode: governs repo mutation, and by the letter of docs/CAPABILITIES.md that's right. But an operator scanning mode: read-only will not expect a $1 USDC transaction on Base to be in scope, and the capabilities doc asks that the documentation surface and the runtime gate agree. I'd rather this pack read mode: write with the gate doing the work than rely on a reader parsing the distinction correctly. Convince me or change it.

2. X402_CMD under the read-only tier. scripts/skill_mode.sh allowlists the read-only tier to a fixed verb set. An arbitrary operator-supplied $X402_CMD (line 130) only runs if it happens to start with npx/node/curl. Net effect is safer than advertised, but you're documenting a path that mostly won't fire. Either constrain it in the docs ("must be an npx/node invocation") or move the skill to mode: write. Related: sed/tr/printf aren't on that allowlist either, and both proof-of-loadout (lines 61, 62, 74) and eth-gas-watch (lines 110, 112, 187) use them under mode: read-only — worth a real headless run to confirm they aren't denied.

Nits — fix if you're pushing anyway

• catalog/skill-packs.json:252 — secrets_optional isn't a registry-level field (it's absent from the field reference in docs/community-skill-packs.md, from the validator's KNOWN_FIELDS, and from the dashboard's CommunityPack type). It's read by nothing and it's the source of the one CI warning. Drop it from the catalog entry; the pack manifest is the right place for it and the installer already surfaces it from there.
• Inconsistent between your own two entries: you list eth-gas-watch's secrets_optional but omit proof-of-loadout's MIROSHARK_PAY/X402_CMD. Those are config flags rather than secrets, so dropping both is the consistent move.
• skills/gas-status/SKILL.md:50 — the ./secretcurl call loses the -fsSL the keyless branch uses. No fail-on-error on the authenticated path.
• proof-of-loadout renders install_command verbatim from sparkleware.fun/api/packs.json (line 68) into output/ and prints it as a runnable command. Not executed, so not a sink today — but it's remote author-controlled text presented to an operator as something to run. Worth labelling as untrusted in the output.
• The "Why" section says "only three of the old seven come back." Two of the seven return (aeon-pulse, eth-gas-watch); arxiv-digest is missing from your not-resubmitted list; proof-of-loadout was never in the pruned set. Doesn't affect the diff, but it reads as more restraint than was exercised.

On the packs themselves

proof-of-loadout is the strongest of the three and clearly answers the #600 thinness complaint — real composition logic, three live services, a genuine two-key gate. I confirmed the spend gate in code (line 128, MIROSHARK_PAY=1 && -n $X402_CMD — both required) and confirmed the $1 USDC / Base / x402 figure against the actual 402 header rather than the description. That's accurate down to the asset address.

aeon-pulse works — all four endpoints live, correctly and narrowly capability-declared, cleanest security profile here. But it's still 4 GETs → format → notify. You fixed every convention #600 named; you didn't really move the substance, which was the other half of that objection. I'll take it, but it sits on the line.

eth-gas-watch — the ./secretcurl "{ETHERSCAN_API_KEY}" placeholder handling is exemplary, exactly as claimed, no bare interpolation anywhere. Shame about the endpoint.

Push the V2 fix and answer (1) and (2), and I'll re-verify and merge.