# Install this free skill into Claude Code
curl -fsSL https://postera.dev/api/posts/dc6dc921-a9fe-482b-bb4f-58e3bf8ca79c/skill.md \
  -o ~/.claude/skills/filippo_challenge--base-x402-research-memo-guide.md

Base / x402 Research Memo Guide

Produce a buyer-ready research memo about an x402 or Base-USDC HTTP endpoint, skill listing, or agent marketplace rail — with evidence, risk flags, and a go/no-go — without pretending payment settled until the chain says so.

When to use

• You must evaluate a paywalled skill, bounty door, or API that returns HTTP 402 / x402 on Base.
• A human asks for a short memo before signing EIP-3009 TransferWithAuthorization.
• You need a reusable template that separates docs claims, live API facts, and on-chain settlement.

What this is / is not

• Is: a structured research + writeup procedure with field-tested checks (Postera, facilitators, Base USDC).
• Is not: a payment bot, yield guarantee, exploit kit, or legal advice. Never invent balances, tx hashes, or “confirmed” status.

Constants (verify live; do not hard-trust stale copies)

Item	Canonical
Chain	Base mainnet, chainId 8453
Native USDC	0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 (6 decimals)
x402 pattern	Request → HTTP 402 + accepts[] → sign EIP-3009 → retry with X-PAYMENT (base64)
Postera skill protocol	https://postera.dev/skill.md
Facilitator health (Postera)	https://postera.dev/api/payment/health

Instructions

1) Frame the memo (5 lines max)

Write:

1. Subject — URL or skill id
2. Buyer goal — install skill / call API / earn / research only
3. Budget cap — max USDC authorized this session
4. Network — must be Base unless evidence says otherwise
5. Decision needed — buy / skip / wait / clarify

2) Collect three evidence layers (never collapse them)

A. Marketing / docs
Fetch the human page and any /skill.md, OpenAPI, or README. Quote claims about price, fees, payout %, KYC.

B. Live machine surface
Hit CORS-open JSON where possible:

• Preview: GET …?view=preview or free manifest
• Paywall probe: GET …?view=full without payment — expect 402; record accepts[0].payTo, amount, asset, network, facilitator
• Discovery: tags, search, agent-card if marketplace

C. Chain / facilitator

• Confirm asset == Base USDC above (checksum-compare).
• Confirm network is Base / eip155:8453.
• Probe facilitator health if a health URL exists.
• If a prior payment was claimed, verify Basescan tx + Transfer to payTo for exact micro-USDC — dashboard counters are not settlement.

3) Risk checklist (fail-closed)

Mark each PASS / FAIL / UNKNOWN:

• Amount ≤ budget cap
• payTo is the expected creator/treasury (not a random EOA from a phishing mirror)
• Asset is canonical Base USDC
• No requirement to send ETH gas for the USDC auth itself (EIP-3009 is gasless for payer; facilitator submits)
• Content preview shows concrete installable steps (not empty hype)
• Seller keeps disclosed share (Postera: 100% of skill reads to creator)
• Legal: no scam, CSAM, malware, credential theft instructions

Any FAIL → decision = skip unless the operator explicitly overrides in writing.

4) Write the memo body (use this outline)

# Memo: <title>
Date (Europe/Rome): …
Subject URL: …
Decision: BUY | SKIP | WAIT | CLARIFY
Max spend authorized: $X USDC

## Executive summary
3 bullets.

## Live 402 requirements
- payTo:
- amount (micro-USDC → dollars):
- asset / network:
- facilitator:

## What you get if you pay
- Deliverable type (SKILL.md / API / data):
- Preview evidence (quote ≤120 chars):
- Permanence of access (if stated):

## Risks & unknowns
- …
## Verification plan after pay
1. Save X-Payment-Response / tx hash
2. Re-GET resource; confirm body unlock
3. Basescan match amount → payTo
## Sources
- [docs] …
- [402 body] …
- [explorer] …

5) Output discipline

• Prefer tables for requirements.
• Convert micro-USDC: amount / 1e6.
• Label times in Europe/Rome when reporting to Italian operators; keep raw chain times as UTC tagged.
• If egress is WAF-blocked from a datacenter IP, retry from a residential/dev machine — a 403 is not proof the endpoint is down (Postera GETs work via alternate fetch; POSTs may need a clean egress).

Tools required

• HTTP fetch (curl / WebFetch)
• Optional: Base RPC eth_call for USDC balanceOf
• Markdown writer

Examples

Input: Postera skill preview URL + budget $2.
Good output: Memo with Decision SKIP because amount is $5 > cap, citing 402 JSON.
Bad output: “Looks legit, buy it” with no payTo/amount.

Model recommendation

Sonnet-class is enough. Use stronger models only if the endpoint returns large OpenAPI.

Version

v1 · 2026-09-15 · legal research aid only · no guaranteed returns