Trust Badges

Trust badges let creators and users verify the safety, reputation, and fitness of AI Skills and Genes at a glance. Powered by the V(g) security scanner and Rotifer Protocol’s reputation system.

Badge Types

Type	Label	Data Source	What it Shows
Safety	`rotifer safety`	V(g) static analysis grade (A/B/C/D/? / `skipped`)	Code security scan result
Reputation	`rotifer reputation`	Gene `reputation_score` from Registry	Aggregate trust score
Fitness	`rotifer F(g)`	Arena fitness value F(g)	Latest Arena competition score
Creator	`rotifer reputation`	Creator reputation score	Author credibility

Safety Badge States

State	Display	Meaning
`A` / `B` / `C` / `D`	Coloured (green → red)	V(g) scan completed; grade reflects findings
`?`	Grey	No code files found (pure-config / pure-prompt Skill)
`skipped`	Grey	Publisher used `rotifer publish --skip-vg` to upload a placeholder without running the scan — interpret as “no safety claim made”
`not scanned`	Grey	No badge has been uploaded for this gene yet

Quick Start

Using the Badge Generator

The easiest way to create a badge is the Badge Generator:

Select a badge type (Safety / Reputation / Fitness / Creator)
Enter the identifier (Skill name, Gene name, or username)
Click Generate to preview
Copy the Markdown snippet into your README

Using the CLI

Run a V(g) scan and embed the safety badge:

$ rotifer vg ./my-skill --id @alice/search-web

Then add to your README:

![Rotifer Safety](https://img.shields.io/endpoint?url=https://badge.rotifer.dev/safety/@alice/search-web)

Automatic Upload via `rotifer publish`

Since v0.9, rotifer publish automatically runs a V(g) scan and uploads the safety badge as part of the publish flow (Phase 1):

$ rotifer publish my-gene                # default: scan + upload self-reported badge
$ rotifer publish my-gene --skip-vg      # skip scan, upload "skipped" placeholder badge
$ rotifer publish my-gene --skip-security  # skip pre-publish checks entirely (no badge upload)

ROTIFER_BADGE_TOKEN must be set in the environment for badge upload; otherwise the publish proceeds and the upload is silently skipped. Badge upload failures are non-blocking — publish succeeds even if the Badge Worker is unreachable.

Embedding Badges

All badges render through shields.io using the Endpoint Badge format.

Markdown

![Safety](https://img.shields.io/endpoint?url=https://badge.rotifer.dev/safety/@author/skill-name)
![Reputation](https://img.shields.io/endpoint?url=https://badge.rotifer.dev/gene/@author/gene-name)
![Fitness](https://img.shields.io/endpoint?url=https://badge.rotifer.dev/gene/@author/gene-name/fitness)
![Creator](https://img.shields.io/endpoint?url=https://badge.rotifer.dev/dev/username)

HTML

<img src="https://img.shields.io/endpoint?url=https://badge.rotifer.dev/safety/@author/skill-name" alt="Rotifer Safety" />

Badge Styles

Append &style= to customize appearance:

Style	Parameter
Flat (default)	`&style=flat`
Flat Square	`&style=flat-square`
Plastic	`&style=plastic`
For the Badge	`&style=for-the-badge`

Example:

![Safety](https://img.shields.io/endpoint?url=https://badge.rotifer.dev/safety/@author/skill-name&style=for-the-badge)

API Reference

The badge API is hosted at badge.rotifer.dev and returns shields.io Endpoint Badge compatible JSON.

`GET /safety/:skill_id`

Returns the V(g) safety grade for a Skill.

Parameter	Description
`skill_id`	Skill identifier (e.g. `@author/skill-name`)

`GET /gene/:identifier`

Returns the reputation score for a Gene.

Parameter	Description
`identifier`	Gene UUID, plain name, or qualified name (`@owner/gene-name`)

`GET /gene/:identifier/fitness`

Returns the Arena fitness score F(g) for a Gene.

Parameter	Description
`identifier`	Gene UUID, plain name, or qualified name (`@owner/gene-name`)

`GET /dev/:username`

Returns the creator reputation score.

Parameter	Description
`username`	Creator username

Response Format

All endpoints return the same JSON schema:

{
  "schemaVersion": 1,
  "label": "rotifer safety",
  "message": "A",
  "color": "brightgreen",
  "cacheSeconds": 3600
}

When the identifier is not found:

{
  "schemaVersion": 1,
  "label": "rotifer safety",
  "message": "not found",
  "color": "lightgrey",
  "cacheSeconds": 3600
}

Gene Identifier Resolution

The /gene/ endpoints accept three identifier formats:

Format	Example	Resolution
UUID	`550e8400-e29b-41d4-a716-446655440000`	Direct lookup
Qualified name	`@alice/search-web`	Query by owner + name
Plain name	`search-web`	Query by name (latest published)

Caching & CORS

All responses include Cache-Control: public, max-age=3600 (1 hour cache)
CORS is enabled for all origins (Access-Control-Allow-Origin: *)