What LVL optimizes for
- No long-lived API key required just to unlock a pack
- Payment verification against Base USDC transfers
- Free outlines so you can refuse before paying
- Public proof ledger for confirmed unlocks
What LVL does not claim
- Not a blanket third-party security certification for every skill author
- Not a promise that open marketplace sellers are risk-free
- Not medical, legal, or financial advice via skill content
- Not invented sales metrics
Escrow and open market
Open listings may use LVLEscrow so funds are held under platform rules. That reduces some counterparty risk. It does not remove the need to read outlines and test with small amounts first.
Buyer checklist
- Read free outline and sample
- Confirm price and skill id
- Allowlist payTo and USDC contract in agent configs
- Prefer canary before large spends
- Verify proof rows on BaseScan when amounts matter
Seller and operator checklist
- No public admin without server-side auth
- Never log secrets in sealed pack samples
- Keep status.json and brand pages accurate (not merch)
- Respond to redeem failures with tx-based support
Report issues
See /.well-known/security.txt and the about page for contact paths. Responsible disclosure beats drive-by griefing of mainnet payment flows.
Phishing and lookalike domains
Bookmark https://lvlltd.com and type it yourself when value is at stake. Check TLS. Check that payment challenges return known payTo values you recorded from official docs or a first successful canary. If a site asks for your seed phrase, it is not LVL.
Agents should hardcode host allowlists to lvlltd.com for shop, pay, and proof. Open redirects into payment flows are a classic footgun; avoid following arbitrary next URLs from untrusted HTML.
Threat model sketch
Buyers face: malicious listings, phishing sites that mimic LVL, wrong-network payments, and over-permissive agent wallets. Sellers face: unpaid scraping of free content, false unlock claims, and chargeback-like social attacks. Platform faces: spam listings, stolen content, and payment griefing.
Controls map to those threats: free eval reduces blind buy risk; chain verification reduces fake receipt risk; escrow reduces some seller default risk; moderation reduces spam; allowlists reduce agent footguns.
Auth standing order
No publicly reachable admin without server-side auth. If you contribute code to LVL properties, treat that as non-negotiable. Client-only hiding is not auth.
Keys and wallets
Agent hot wallets should be expendable. Treasury wallets should be cold or multisig per your policy. Never embed private keys in skill packs. Rotate when people leave projects.
Content trust
A sealed pack can still contain bad advice. Payment verification is not peer review. Use finance and medical adjacent skills with professional oversight. Neurotech content especially needs careful reading.
Incident response for buyers
- Stop automated purchasing
- Collect txHashes and challenge logs
- Verify on BaseScan
- Contact sellers or platform with evidence
- Rotate keys if a pack may have exfiltrated secrets (should not, but assume breach discipline)
Platform transparency pages
status.json, /status/, proof, security.txt, and about pages exist to reduce ambiguity. If they conflict with a random tweet, prefer primary surfaces on lvlltd.com.
Field notes from live rails
Everything in this guide is meant to match production behavior on lvlltd.com: free outlines at /skills/{id}/outline.json, challenges at /api/pay, settlement in USDC on Base chain ID 8453, unlock proofs that can be checked on BaseScan, and a public ledger at /api/proof that refuses to invent volume. If a third-party article disagrees with those primary surfaces, trust the primary surfaces.
When you teach teammates, walk them through one canary unlock before any architecture debate. Shared scars on a $0.05 purchase create better systems design conversations than slides alone. Keep notes on what confused people; those notes should become checklist items in your internal runbook and, if you sell skills, clearer outline text for the next buyer.
Finally, remember the integrity line that LVL repeats for a reason: understanding is free; sealed capability is optional and paid. Education pages like this one should make you more demanding, not more impulsive. Read outlines. Allowlist addresses. Prefer small spends first. Verify. Then scale.
Related live checks
After reading, run at least two live checks: open the free outline for a skill you care about, and open /api/proof. Optionally issue a pay challenge with curl and confirm you see HTTP 402 with amount and payTo fields. Those three actions connect this article to production reality in under two minutes.
If you maintain internal wiki mirrors of these guides, include the canonical URLs on lvlltd.com so agents and humans can detect drift. Canonicals and llms.txt exist so education stays discoverable next to commerce, not buried in a slide deck.