Remove partner skills, consolidate licensing, add SECURITY.md

.claude-plugin/marketplace.json

@@ -36,18 +36,6 @@
         "./skills/moonpay-virtual-account",
         "./skills/moonpay-x402"
       ]
-    },
-    {
-      "name": "partner-skills",
-      "description": "Skills that integrate MoonPay wallet and payment capabilities with third-party platforms.",
-      "source": "./",
-      "strict": false,
-      "skills": [
-        "./skills/corbits",
-        "./skills/dune",
-        "./skills/shipp",
-        "./skills/yield"
-      ]
     }
   ]
 }

.github/PULL_REQUEST_TEMPLATE.md

@@ -10,8 +10,7 @@
 
 ## Checklist
 
-- [ ] `skills/{name}/SKILL.md` with YAML frontmatter (`name`, `description`, `license`)
-- [ ] `skills/{name}/LICENSE.txt`
+- [ ] `skills/{name}/SKILL.md` with YAML frontmatter (`name`, `description`)
 - [ ] Skill added to `.claude-plugin/marketplace.json`
 - [ ] Description is specific about when Claude should trigger this skill
 

.github/workflows/trufflehog.yml

@@ -0,0 +1,15 @@
+# This is an automatically generated file, please do not edit!
+# If you want to make any changes see: https://github.com/moonpay/ghsec
+
+name: Secret Scanning
+
+on:
+  pull_request:
+    branches:
+    - "*"
+
+jobs:
+  trufflehog:
+    name: Trufflehog
+    uses: moonpay/ghsec/.github/workflows/trufflehog-shared.yml@v1
+    secrets: inherit

CLAUDE.md

@@ -0,0 +1,46 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Overview
+
+This is a repository of **Agent Skills** for crypto infrastructure. Skills are Markdown-based instruction files that AI agents (Claude Code, Claude API, MCP clients) load dynamically to perform specialized tasks via the MoonPay CLI (`mp`).
+
+Skills are **not code** — they are instructional guides. All execution happens through the MoonPay CLI (`@moonpay/cli`). There is no build, test, or lint step.
+
+## Repository Structure
+
+- `skills/` — All skill definitions (each skill is a directory with `SKILL.md` and `LICENSE.txt`)
+- `.claude-plugin/marketplace.json` — Plugin registry defining two groups: `moonpay-skills` (core) and `partner-skills` (third-party integrations)
+- `spec/agent-skills-spec.md` — Links to the full Agent Skills Specification at https://agentskills.io/specification
+- `template/SKILL.md` — Minimal template for creating new skills
+
+## Skill Anatomy
+
+Each skill is a directory under `skills/` containing a single **`SKILL.md`** file with YAML frontmatter:
+```yaml
+---
+name: skill-name
+description: When to use this skill and what it does
+tags: [tag1, tag2]        # Optional
+---
+```
+The body contains instructions for the agent: setup commands, workflows, configuration, and references to other skills. The repo-level `LICENSE` covers all skills.
+
+## Adding a New Skill
+
+1. Create `skills/{name}/SKILL.md` using the template in `template/SKILL.md`
+2. Add the skill entry to `.claude-plugin/marketplace.json` under the appropriate plugin group
+4. The PR template (`.github/PULL_REQUEST_TEMPLATE.md`) defines the required checklist
+
+## Skill Groups in marketplace.json
+
+- **moonpay-skills** — Core MoonPay capabilities (auth, wallets, trading, fiat ramp, etc.)
+- **partner-skills** — Third-party integrations (corbits, dune, shipp, yield)
+
+## Key Conventions
+
+- The `description` field in YAML frontmatter should be specific about **when Claude should trigger** the skill — this is how agents decide which skill to load
+- Many skills reference each other (e.g., swap recommends check-wallet and discover-tokens) — maintain these cross-references when editing
+- Skills instruct agents to use config files under `~/.config/` (e.g., `~/.config/moonpay/`, `~/.config/pump-fun-sniper/`)
+- The MoonPay CLI binary is invoked as `mp` in skill instructions

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 MoonPay
+Copyright (c) 2026 Hypermint EU Limited
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -86,16 +86,6 @@ See the [moonpay-mcp](skills/moonpay-mcp/SKILL.md) skill for setup details.
 | [moonpay-price-alerts](skills/moonpay-price-alerts/) | Desktop notifications when tokens hit target prices |
 | [moonpay-commerce](skills/moonpay-commerce/) | Browse Shopify stores and checkout with crypto |
 
-### Partner Skills
-
-Skills that integrate MoonPay wallet and payment capabilities with third-party platforms.
-
-| Skill | Description |
-|-------|-------------|
-| [corbits](skills/corbits/) | Paid API marketplace with x402 USDC micropayments |
-| [dune](skills/dune/) | On-chain analytics with wallet management |
-| [shipp](skills/shipp/) | Sports data and Polymarket trading |
-| [yield](skills/yield/) | Multi-chain yield opportunities |
 
 ## Adding a New Skill
 
@@ -113,7 +103,6 @@ name: your-platform
 description: >
   What your platform does and how it integrates with MoonPay.
   Be specific about when Claude should use this skill.
-license: Complete terms in LICENSE.txt
 ---
 
 # Your Platform + MoonPay
@@ -135,14 +124,12 @@ Key commands and workflows that combine your platform with MoonPay.
 Real-world usage examples.
 ```
 
-3. Copy `LICENSE.txt` from any existing skill into your directory.
-
-4. Open a PR. Include:
+3. Open a PR. Include:
    - A brief description of your platform and the MoonPay integration
    - Which chain and token your integration uses
    - Example usage showing the end-to-end workflow
 
-See existing partner skills ([corbits](skills/corbits/), [shipp](skills/shipp/), [dune](skills/dune/), [yield](skills/yield/)) for reference.
+See existing skills under `skills/` for reference.
 
 ### For MoonPay internal skills
 

SECURITY.md

@@ -0,0 +1,36 @@
+# Security
+
+No technology is perfect. We believe collaborating with skilled security researchers across the globe is crucial to identifying weaknesses in any technology.
+
+If you believe you have found a security issue in MoonPay, we encourage you to notify us. We welcome working with you to resolve issues promptly.
+
+## Disclosure Policy and Process
+
+Please submit your finding through our [HackerOne disclosure program](https://hackerone.com/moonpay) as soon as possible after discovering a potential security issue.
+
+1. Submit a report via HackerOne.
+2. Once we assess your report, a member of our team will help triage the vulnerability.
+3. Once a fix is ready, we will include it in an upcoming release.
+
+When testing, please make a good faith effort to avoid:
+- privacy violations
+- data destruction
+- service interruption or degradation
+
+Only interact with accounts you own or accounts for which you have explicit permission from the account holder.
+
+## Exclusions
+
+While researching, please follow the defined [program scope](https://hackerone.com/moonpay?type=team#program_highlights).
+Failure to do so may result in rejection of the submission.
+
+The following are out of scope:
+- Denial of service (DoS)
+- Spamming
+- Social engineering (including phishing) of MoonPay staff or contractors
+
+## Safe Harbor
+
+Any activities conducted in a manner consistent with this policy are considered authorized conduct, and we will not initiate legal action against you.
+
+Thank you for helping keep MoonPay and our users safe.