showcase: add PaliSade onchain security scanner

[palisadescan]

Showcase Project

What shipped

• Project slug: palisade
• Project title: PaliSade
• Builder name and URL: palisadescan — https://palisadescan.com
• EconomyOS primitives used: acp
• Public proof: reproducible live-endpoint calls against the public API https://mcp.palisadescan.com — see showcase/palisade/examples/live-endpoint-proof.md (health, tools/list, safety score, honeypot, six-source consensus)
• Optional soul.md: showcase/palisade/soul.md (public, redacted agent context)

Project package

• Added or updated showcase/<project-slug>/showcase.json
• Added demo artifacts, prompt, proof, or redacted report
• Added reusable skill under showcase/<project-slug>/skills/<skill-name>/ when it belongs to this project package
• Used top-level skills/<skill-name>/ only when the skill is shared across projects
• Set skills[].sourcePath in showcase.json for any skill committed in this repo
• Linked all public artifacts from the manifest
• Included exactly three feedback prompts
• Set hidden: true only if this package should merge without publishing its public Showcase card yet
• Linked soul.md only if the builder intentionally wants to publish public, redacted agent context

Skill standard

• Skill path: showcase/palisade/skills/palisade-security-scan
• SKILL.md includes when to use it and when not to use it
• Inputs, tools, credentials, and preconditions are explicit
• Approval gates are listed (none — read-only; downstream actions hand off)
• Stop conditions and handoff rules are listed
• Validation checks and output contract are included

Safety and redaction

• No card numbers, CVVs, OTPs, magic links, API keys, access tokens, private prompts, wallet material, or private account records are published
• Live workflow evidence is redacted (public WETH address only; keyless API)
• Public/private boundaries are explained
• Optional soul.md does not include private instructions, credentials, account data, wallet material, or operational secrets

Notes

PaliSade is a keyless, read-only onchain security scanner exposed as an MCP server. It never signs, holds keys, or moves funds. Primary chain is Robinhood Chain (chainId 4663); Ethereum, Polygon, Arbitrum, and Solana are supported for cross-chain checks. Validated locally with node scripts/validate-showcase.mjs (passes). The poster resolves 200 on the fork branch; the manifest references the upstream main raw URL, which resolves after merge.