Plate 00 · two skills

An agent can do the reading. It cannot do the authorizing.

Two installable skills, and the difference is whose organization it is. verified-giving walks you through publishing your own declaration. vgpify reads a nonprofit’s site you do not run and gathers evidence for review.

Neither may authorize a destination. Both stop and hand that decision to a person.

Plate 01 · for your own organization

Publish your declaration.

You already know your legal name, your EIN and where your donate page is. This skill turns that into a valid, authorized, discoverable file — and refuses to authorize anything on your behalf.

install claude code

npx degit WholeWhale/verified-giving-protocol/skills/verified-giving ~/.claude/skills/verified-giving

Then ask it to set up VGP for our nonprofit.

01 Your domain
Which host actually serves root files without redirecting, checked against robots.txt.
02 Your legal entity
The EIN is verified against the IRS Business Master File rather than taken as typed. This routinely catches a legal name off by a missing "Inc".
03 Your pathways
Method, processor, currency, recurrence, and the name your checkout actually shows the donor.
04 Your prefill contract
Established by testing your live donate page, never inferred — including the ceiling above which a platform silently ignores an amount.
05 Your authorization
You type the affirmation verbatim. The skill runs the approval script; it does not write the block itself.
06 Validate and publish
Both validators, then the file at your document root as application/json, with no redirect.
07 Advertise it
A visible link, schema.org markup, an llms.txt entry, the link relation. Publishing is not discovery.

Figure 01 · step 05 carries ink 3, the ink reserved for authorization. It is the only step with no tooling, and that is deliberate.

Plate 02 · for a site you do not run

Audit someone else’s giving pathways.

VGPify crawls a nonprofit’s site, works out which legal entity receives the money, evidences every donation pathway it can find with source URLs and excerpts, flags where the evidence disagrees with itself, and produces a review document. It is the skill that drafted this protocol’s reference implementation, and the reason that declaration carries evidence rather than assertions.

install claude code

npx degit WholeWhale/verified-giving-protocol/skill ~/.claude/skills/vgpify

Then ask it to vgpify example.org.

Candidates it finds are written into a separate review document that cannot authorize anything. Never into a declaration. No volume or quality of evidence converts a discovered destination into an authorized one, and the tooling enforces that rather than asking: the approval script compares the affirmation as a constant and refuses a paraphrase. Discovery may propose; only a human at the nonprofit may publish.

Read the skills