sumup — 6 skills

Pinned source listing — machine-checked

What declarations and files are present in this pinned source?

Pinned source declarations and file hashes were listed.

Review

Machine-checked · 2026-10-19

Run UTC: 2026-10-19T21:10:59Z
Reviewed: 2026-10-19
Published: 2026-10-19
Updated: 2026-10-19

Observations · Limitations · Evidence

Works with:

Works with Claude Code

Works with Codex

Works with Gemini CLI

Works with Grok Build

What we ran

Git blob acquisition followed by static source inspection.

What we saw

Listed 6 skill declarations. Ran 85 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.

Limits

Scope: acquisition and static inspection. Command results: commands.json.

developer-tools · skills · Upstream source · Upstream documentation

Pinned source inspection only; no runtime platform was exercised. UTC 2026-10-19T21:10:59Z, tree ce64bba840fa1143637d692ff2c1277118cc2db6789c9308e58738ea0d084a57.

No browser or computer-use tools. Pin this exact version; the stamp does not follow updates.

Full record

name: sumup — 6 skills
slug: source-skills-8b49fe84ff3613cfedfe246c
type: skills
category: developer-tools
example: false
evidence state: pinned_source_listing
stamp: Pinned source listing — machine-checked
summary: Pinned source declarations and file hashes were listed.
outcome: Listed 6 skill declarations. Ran 85 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.
rule results: ["The retained source tree matches its acquisition manifest.","Declared skill names (listing.json): sumup; sumup-best-practices; sumup-debug; sumup-mcp; sumup-testing; upgrade-sumup"]
task: What declarations and files are present in this pinned source?
setup: Git blob acquisition followed by static source inspection.
limitations: Scope: acquisition and static inspection. Command results: commands.json.
source url: https://github.com/sumup/sumup-skills.git
documentation url: https://github.com/sumup/sumup-skills.git
commit: 6922c7052ae9d0be834f27361b785bd80e0829cc
tree sha256: ce64bba840fa1143637d692ff2c1277118cc2db6789c9308e58738ea0d084a57
file sha256: {".agents/plugins/marketplace.json":"e0c709dc4ec8cdc8e96715f2f1cf71cbbad3ba065186a4801954019899a61bea",".claude-plugin/marketplace.json":"cba17405a80fe527960e9e713c1350ec8c03c0d0c9aa279beb2ea131320f1fac",".claude-plugin/plugin.json":"9c7f418ee6db23759f7bb3523e2ca36f1fb8f5bc0b78656d25d686fe2d0a74ce",".codex-plugin/plugin.json":"86f233cefb3462dd4b97b64369c5e484fa784c20391758f72889857eed72c93d",".cursor-plugin/marketplace.json":"3e8e50f31dc7d9dd8e1e946a7db39e5aec05450159c0c55e70d2ebc1d39c1de4",".cursor-plugin/plugin.json":"bec0130cf8d1f0812f764b99f68cf49d8078bc9b9c4bd40d921d6222047b4240",".github/dependabot.yml":"e0f89c3d5b2bc229bb4844d8c2e8cec80f6ba9d6a74e3ff79856c6f568417a2b",".github/workflows/lint.yaml":"12212e5a9f13179970e9870286f5e51381e6f1eb73184ece44655c89abdc3aea",".github/workflows/sync-agent-skills-discovery.yaml":"fd58c7223b5a61db2ea7d028c1e92d6ddca39467bf6bd0a175abbfc667471821",".github/workflows/validate-skills.yaml":"1d40936b19b10cda05b2a346e2006a41aa0151d9a09e451f972995aaf6e12860",".mcp.json":"79173f0fd26523696199f864d0fc68957298b36a5919c69210ca3fbc0b847416",".rumdl.toml":"7a56ab7186dcd1ff0110068315f6af8be54602db909174739b541212b18aa6ac","CODE_OF_CONDUCT.md":"765ec10f57a9eb82bb8731573157ca24347618fdba93670ab9cd6008f5b95b3a","CONTRIBUTING.md":"953a3fb3906b22d35d74e2213dd2c3a9efba1e92ea54a920c978fa8cb6a49312","CURSOR_DESKTOP_VERIFICATION_CHECKLIST.md":"4e20b93a6b47835672a3277aa26e3caa6ce2da94caab7173ea66fa2edcbd9385","GEMINI.md":"205d331e2b18c66e10947a17d429bb306267700e605c187ddc656d29944ee704","LICENSE":"b731e279589e809664450d7e89c311bb1954460017101b02381693cc5d4d8720","POWER.md":"67666ffe9956e64a6aeed01a666b5ea514455957740304abea821017f82b2cad","README.md":"7a60e7837beafc0cf8fdc879373a28953933d54d72aa343ecbe800d76ecee455","assets/icon.png":"6ff593c4ad552dac01a10b8ef460ff916ec15196d795a1e27ae2e8320c872912","assets/logo.png":"bb9a9184e7b1ed772736bfb11555333eabe0a8c816f2b6bcb239db6ba5edb213","gemini-extension.json":"56af686ad4d1929df4c8c21f7235a430c8eb47c967384b7198808ec9af8f0f0c","justfile":"8d33ecf204d532ba364e1ad6243e7f47822e7ee7875870886c76a4883719d875","mcp.json":"79173f0fd26523696199f864d0fc68957298b36a5919c69210ca3fbc0b847416","scripts/export-agent-skills-discovery.go":"14a8341d867344a518c251687bd04e125b69af27f2c29cc48d30c971afff1316","scripts/sync-skills.sh":"9e3974e210119bd013429dfa364ab11478c825a24a27d48cc72203c6d48e15a6","skills/sumup-best-practices/SKILL.md":"1d210ff2a82a7c3f51ddaa1c698139348a0a3668288591ba060db70e5396331a","skills/sumup-best-practices/agents/openai.yaml":"120fbaac6332d294b23a1647092c476abf6228d80a9751e84afef70b18da2efd","skills/sumup-best-practices/assets/large-logo.png":"7d029c0b81e49010086b32061ab872c0b71f76ee3dfde25e7b6c98731807fba5","skills/sumup-best-practices/assets/small-logo.svg":"05a2cd4999852c382e8f3556f5523f735529efa8cd19194a5d75756c7295e554","skills/sumup-debug/SKILL.md":"473fb06d1af188461b9abfffd834d4968bd6ca453853d365f406be578f862f2b","skills/sumup-debug/agents/openai.yaml":"43892cf9b369cd3c87a80463b549d0c2b1cbc6981b709b7053643b4ddb623caa","skills/sumup-debug/assets/large-logo.png":"7d029c0b81e49010086b32061ab872c0b71f76ee3dfde25e7b6c98731807fba5","skills/sumup-debug/assets/small-logo.svg":"05a2cd4999852c382e8f3556f5523f735529efa8cd19194a5d75756c7295e554","skills/sumup-mcp/SKILL.md":"dd84c60e46c5805b8689a912f1fb6d97532c1e026f7e4cf400af56284a4c6a72","skills/sumup-mcp/agents/openai.yaml":"220d4d60816e26ab87185f57892be00e4f9b5964bd4a51679a4a6ce4383aa7ea","skills/sumup-mcp/assets/large-logo.png":"7d029c0b81e49010086b32061ab872c0b71f76ee3dfde25e7b6c98731807fba5","skills/sumup-mcp/assets/small-logo.svg":"05a2cd4999852c382e8f3556f5523f735529efa8cd19194a5d75756c7295e554","skills/sumup-testing/SKILL.md":"679fc7faa8e44ab09eb4d8213cde40c7d8365a4b69f521c10d81e7070b8fc793","skills/sumup-testing/agents/openai.yaml":"c718047908fd830878ffd7d94ca159bfdb1d409f44860bfc68126db395cf45dd","skills/sumup-testing/assets/large-logo.png":"7d029c0b81e49010086b32061ab872c0b71f76ee3dfde25e7b6c98731807fba5","skills/sumup-testing/assets/small-logo.svg":"05a2cd4999852c382e8f3556f5523f735529efa8cd19194a5d75756c7295e554","skills/sumup/SKILL.md":"da97944f73e7a25a3fe69f6d75827de28995885939455915b06f0cc9afacb2bb","skills/sumup/agents/openai.yaml":"cee6e0078d0e327355e966947a73c9f152dd3ae4c6937fab7d78947f7e4d6297","skills/sumup/assets/large-logo.png":"7d029c0b81e49010086b32061ab872c0b71f76ee3dfde25e7b6c98731807fba5","skills/sumup/assets/small-logo.svg":"05a2cd4999852c382e8f3556f5523f735529efa8cd19194a5d75756c7295e554","skills/sumup/references/README.md":"4080bf312864729b54aeb41cb03918f2874a0f45acb865167e76aceec293073e","skills/sumup/references/android-reader-sdk/README.md":"9812445d0177767f87ea801e94cf2b41429e5059ba539bf7c8c7cc77a644cac4","skills/sumup/references/android-tap-to-pay-sdk/README.md":"0be520ed675a3ee0ef6b83ecaf3614ba93e4e74d64db752c3231f3a53b45647e","skills/sumup/references/apm/README.md":"16c3e6927f2dd108c0f794431cb8f285e10d32ec1a50a08c99c6f527a4ce3a5b","skills/sumup/references/checkout-playbook.md":"b05d57376f1949fa459f4449246d0dce2e9cbc6490989b1158d89371f699cb21","skills/sumup/references/checkout-widget/README.md":"9a30391b50f5420bb6887884d19ae1ef6949d3e56633bf427c2775d5bb379f9a","skills/sumup/references/checkouts-api/README.md":"1891abb26a9aa5559e403d3d5adc2c19f585740701cc0e6c6d530f90f06385cc","skills/sumup/references/cloud-api/README.md":"9135b8184ed62a2bd9102e1ffb21d42b98af77c564865fc9ff84f0a2f9851830","skills/sumup/references/dotnet/README.md":"501d22c9fbee97f8835f71da86b8bd39fc989e77ddf42c6ae31fc10f76d41f6c","skills/sumup/references/go/README.md":"4477863afd5b5b194ad8433afb9cc70c37e680a95c1cf4a8d1021b9200200fea","skills/sumup/references/hosted-checkout/README.md":"8a19ae47a8dd9867f75dc3305f79fc1fc6cd1fcf01c839d6cb6d62a28f71fe11","skills/sumup/references/ios-terminal-sdk/README.md":"75b55292b2599b4143396e0d5e679e0cbd06ef41328a044e94e1cfa745e3455e","skills/sumup/references/java/README.md":"d9595770b9c151e8c477a69701ce8e43595cd7558e97859e808dbb4b9f3e1a73","skills/sumup/references/nodejs/README.md":"ecc5a18c5450eb88db05939e07b8c12b697d418aca4baf4c88cdd66cca5f0dd8","skills/sumup/references/online-testing/README.md":"6f2b367277fc397146abd2a5f7a0e4c43d1f14d61a61f50f71c0ae0cafa28d14","skills/sumup/references/payment-switch/README.md":"fe20db322c1afccb68eae89a858f582b5ba4b450b59df90a9804bfeec2f71719","skills/sumup/references/php/README.md":"574bd9a58ad2b8728742bca97c804d91b7a06fadb01133078ce27268c43858fb","skills/sumup/references/python/README.md":"d8531bf1e5449e0c321a0e9c7ae8df597bf949a73b633f7f1395335d9c92688f","skills/sumup/references/react-native-sdk/README.md":"e844549c1945b929e051368548f159c932fd303dbdbc1ddb367f0f1f404910d2","skills/sumup/references/recurring-tokenization/README.md":"b67c848083078fdc8d7fb59b9846cef108e45ab791e46ea03c3a1685c1fd9283","skills/sumup/references/rust/README.md":"1306324bfd2bc58ba1e5fdb850c7ee6cc84b6e5fb8e75a4f5f914ad6d0121058","skills/sumup/references/security/README.md":"04c7d06c78c6024510fb0c8d1f8de4cdac4687efe2f1a1d3eb38515a8f51a8a8","skills/sumup/references/swift-checkout-sdk/README.md":"75ab1a32462b1583385204fcc028c729a2e789f6cb1e1371e0e8adb8c2f4d5e7","skills/sumup/references/webhooks-3ds/README.md":"e6c2876d9a5d54e70eb36be32437f251ee2c0410c1e2741b21b0533dc18dbdb8","skills/upgrade-sumup/SKILL.md":"436ba1caf1d7ab23683bfecbebdf2ae067da40b6142495157d5f893db1ed01a7","skills/upgrade-sumup/agents/openai.yaml":"72e606b679ad429e7a94e5f7633ce3a7da521387c415d81d3334bc8a9f433281","skills/upgrade-sumup/assets/large-logo.png":"7d029c0b81e49010086b32061ab872c0b71f76ee3dfde25e7b6c98731807fba5","skills/upgrade-sumup/assets/small-logo.svg":"05a2cd4999852c382e8f3556f5523f735529efa8cd19194a5d75756c7295e554","steering/best-practices.md":"c8c1a6d2d77576ef77ef04cca8a4a293b340605125fa9761fd73e77ce8073e6d","steering/checkout-integrations.md":"3762f09556662aa4e6a77231c5c950262b0403b3704958fb1efcbccf19700951","steering/debugging.md":"2d44a0191ea2ce2211e5eb241d263c8191e9717f419be8dad43557d9d93d0db6","steering/mcp.md":"116d62fb9e61c84a81522dc0b962f52bfa5025d5f7c8b2932ac715a678e4def4","steering/testing.md":"dbe51da3f64e5c3d046bc2be5ef3faa146112f4fcd755972727f868d4168f28f","steering/upgrades.md":"96c5535b9e04a212febecc1c7000903d82cbddaeb471fc5668f7efa39bae59cf"}
lockfiles: ["LOCK.json"]
utc date: 2026-10-19T21:10:59Z
source date: 2026-10-16
discovered date: 2026-10-16
retested date: 2026-10-19
reviewed date: 2026-10-19
published date: 2026-10-19
modified date: 2026-10-19
reviewer: Machine-checked
harness version: toolwitness harness at commit c2f903d8a014d7d191e486068c85924c63e43903
claude code version: Not applicable: static source inspection (commands.json).
model id: Not applicable: static source inspection (commands.json).
scanner version: Not applicable: static source inspection.
rulepack version: Not applicable: static source inspection.
agents: []
commands: ["Ran 85 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."]
prompt list: ["Not applicable: static source inspection (commands.json)."]
history: ["2026-10-19T21:10:59Z: pinned source inspection"]
application: {"applicationCategory":"DeveloperApplication","name":"sumup — 6 skills","operatingSystem":"Not exercised","softwareVersion":"6922c7052ae9d0be834f27361b785bd80e0829cc"}
review input: {"claims":[{"field":"summary","id":"acquired","sources":["LOCK.json","listing.json","commands.json"],"text":"Pinned source declarations and file hashes were listed."},{"field":"outcome","id":"listed","sources":["LOCK.json","listing.json","commands.json"],"text":"Listed 6 skill declarations. Ran 85 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."},{"field":"rule_results.0","id":"tree","sources":["LOCK.json","listing.json","commands.json"],"text":"The retained source tree matches its acquisition manifest."},{"field":"rule_results.1","id":"declared","sources":["LOCK.json","listing.json","commands.json"],"text":"Declared skill names (listing.json): sumup; sumup-best-practices; sumup-debug; sumup-mcp; sumup-testing; upgrade-sumup"}],"evidence_sha256":{"LOCK.json":"648ed594ba18105a9cfbd200cafaeed17921db1762b59b9fe9e6fb90ffcbc8ad","commands.json":"da9da02d2b73a4dd4c49298d9b8dc855e7a2bc78a3fc79990d51fbe6e84d757f","complete.json":"91b504b43905fdc009504d516c45eea831f39a1995b9e7d69987c9756c936d6f","identity.json":"33fa64a8f90daa017612e41a4ec91b5201b20ecb24eba8b216317ad4398863b3","listing.json":"dfd92e0f88608049f08d8bcfc09d7932ed67d015b99080c0b4188a589f6cda4d","selection.json":"0ee6cf5e2f4ac80ffc4bfc9e72e290a9fb8ed9071f6f87aa9ccbfb1f0280b786"},"identity_artifact":"identity.json"}
review: {"codex":"b7a6a9786aedcf333ef0e6f6d2e38fc1993228c62ec7e4ec6c9158a54c7d440a","date":"2026-10-19","gates":"efda9f12c896b5d3cda5d2e81323c31f46d518ae9e76eb666f0add884987d3d4","grok":"d67d52707a0271a11204c64dc091add6f1de92243ad8749a4279b71f3082be69","kind":"machine-checked","reviewed_sha256":"7da758f5e225ee84db07a7e672f8a55f2dd49716b971bca4f8b8b9dda26435a9","summary":"Deterministic gates passed; every claim rebuilt from evidence with a reviewed template; Grok reported no standing refutation."}

Downloadable evidence

transcript

Download complete transcript

Ran 85 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.

sinkhole log

Download complete sinkhole log

Not applicable: static source inspection (commands.json).

canary log

Download complete canary log

Not applicable: static source inspection (commands.json).

scanner output

Download complete scanner output

Not applicable: static source inspection (commands.json).

normalized text

Download complete normalized text

{
  "listing": {
    "skills": [
      {
        "path": "skills/sumup/SKILL.md",
        "name": "sumup",
        "description": "Implement SumUp checkout flows end-to-end. Use when writing or reviewing SumUp Checkouts API calls, Card Widget mounts, Hosted Checkout setup, recurring tokenization, Terminal SDK / Cloud API reader checkouts, or 3DS / webhook handling.",
        "files": {
          "skills/sumup/SKILL.md": "da97944f73e7a25a3fe69f6d75827de28995885939455915b06f0cc9afacb2bb",
          "skills/sumup/agents/openai.yaml": "cee6e0078d0e327355e966947a73c9f152dd3ae4c6937fab7d78947f7e4d6297",
          "skills/sumup/assets/large-logo.png": "7d029c0b81e49010086b32061ab872c0b71f76ee3dfde25e7b6c98731807fba5",
          "skills/sumup/assets/small-logo.svg": "05a2cd4999852c382e8f3556f5523f735529efa8cd19194a5d75756c7295e554",
          "skills/sumup/references/README.md": "4080bf312864729b54aeb41cb03918f2874a0f45acb865167e76aceec293073e",
          "skills/sumup/references/android-reader-sdk/README.md": "9812445d0177767f87ea801e94cf2b41429e5059ba539bf7c8c7cc77a644cac4",
          "skills/sumup/references/android-tap-to-pay-sdk/README.md": "0be520ed675a3ee0ef6b83ecaf3614ba93e4e74d64db752c3231f3a53b45647e",
          "skills/sumup/references/apm/README.md": "16c3e6927f2dd108c0f794431cb8f285e10d32ec1a50a08c99c6f527a4ce3a5b",
          "skills/sumup/references/checkout-playbook.md": "b05d57376f1949fa459f4449246d0dce2e9cbc6490989b1158d89371f699cb21",
          "skills/sumup/references/checkout-widget/README.md": "9a30391b50f5420bb6887884d19ae1ef6949d3e56633bf427c2775d5bb379f9a",
          "skills/sumup/references/checkouts-api/README.md": "1891abb26a9aa5559e403d3d5adc2c19f585740701cc0e6c6d530f90f06385cc",
          "skills/sumup/references/cloud-api/README.md": "9135b8184ed62a2bd9102e1ffb21d42b98af77c564865fc9ff84f0a2f9851830",
          "skills/sumup/references/dotnet/README.md": "501d22c9fbee97f8835f71da86b8bd39fc989e77ddf42c6ae31fc10f76d41f6c",
          "skills/sumup/

Excerpt shown; complete evidence is in the download.

Download full record JSON

Disclaimer

This record lists declarations and file hashes from a pinned source tree. Git command results from acquisition and static inspection are retained in commands.json. Scope: acquisition and static inspection. It is not a security or quality verdict. Changed bytes are outside this record.

Template placeholders refer to the snapshot metadata above.

Page updated 2026-10-19