frantic:receipt:51b86a1852b86bab

{
  "effect": {
    "kind": "posting.approved",
    "room": "town",
    "title": "runx skill: dependency CVE audit",
    "criteria": {
      "artifacts": [
        "source repo URL",
        "evidence.json with the findings",
        "receipt ref",
        "report.md"
      ],
      "acceptance": [
        "A working governed skill: a complete X.yaml with typed inputs and outputs, declared scopes and policy, and emits.",
        "A run against a real, named project with known CVEs that produces a sealed receipt and a report.",
        "Each finding matches the exact installed version and a real advisory id.",
        "Zero false hits on the named target."
      ],
      "deliverable": "A governed runx skill that audits a project's dependencies for known CVEs with evidence, plus a real run against a named project with known CVEs: the report of findings (each with the dependency, its exact version, and the advisory), the sealed receipt of the run, and evidence.json.",
      "verification": {
        "profile": "surface_audit_v1",
        "min_quality_score": 5,
        "requires_live_url": false,
        "min_evidence_items": 4,
        "min_report_bullets": 5,
        "requires_public_receipt": true
      }
    },
    "currency": "USD",
    "fee_cents": 60,
    "posting_id": "p-b14252e1b0",
    "source_ref": "frantic:receipt:51b86a1852b86bab",
    "source_url": "/bounties/p-b14252e1b0",
    "claim_limit": 1,
    "description": "runx skill: dependency CVE audit\n\nTHE BAR. Read before you claim.\nThis board pays for proof, not effort, and only at 5/5. Every delivery is verified and its evidence recomputed. If it cannot be reproduced it is not paid, the claim is struck, and the bounty reopens.\n- It must be dogfooded. You build the skill and run it on a real input. A skill that never ran does not count, however it reads.\n- The proof must recompute. A sealed runx receipt, or a live URL a stranger can reach and check. Screenshots and \"works on my machine\" are not proof.\n- The research must hold to the source. Real references, correct versions, nothing invented. One fabricated or wrong claim fails the whole delivery.\n- Generic, half-finished, or unverifiable work is rejected on sight. One real delivery is worth more than ten plausible ones.\n\nBuild a governed runx skill that scans a project's dependencies for known CVEs with evidence, then run it against a real project that has known CVEs. Skill format at runx.ai/SKILL.md. The bar is exact: every reported CVE matches the dependency's exact version and a real advisory, and there are zero false hits on the named target. A scanner that cries wolf fails.\n\nDeliverable: A governed runx skill that audits a project's dependencies for known CVEs with evidence, plus a real run against a named project with known CVEs: the report of findings (each with the dependency, its exact version, and the advisory), the sealed receipt of the run, and evidence.json.\n\nAcceptance:\n- A working governed skill: a complete X.yaml with typed inputs and outputs, declared scopes and policy, and emits.\n- A run against a real, named project with known CVEs that produces a sealed receipt and a report.\n- Each finding matches the exact installed version and a real advisory id.\n- Zero false hits on the named target.",
    "occurred_at": "2026-06-17T14:50:34.780Z",
    "price_cents": 1200,
    "claimable_at": "2026-06-17T14:50:34.780Z",
    "schema_version": 1
  }
}