Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed paid lookup helper for Brazilian company verification and does not show hidden code, persistence, or unrelated behavior.
Before installing, be aware that lookups disclose the queried Brazilian company identifier or name to api.brazilayer.com and paid routes can spend small amounts of USDC through x402/agentcash. Use it for intended KYB checks and confirm paid calls when the query or business relationship is sensitive.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
name: brazil-kyb
description: Verify any Brazilian company (CNPJ) with official data: registry status, partners, sanctions, bank licence, contracts, funds. Pay per call via x402.
version: 1.0.0
homepage: https://api.brazilayer.com/docs
metadata:
openclaw:
emoji: "🇧🇷"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
name: brazil-kyb
description: Verify any Brazilian company (CNPJ) with official data: registry status, partners, sanctions, bank licence, contracts, funds. Pay per call via x402.
version: 1.0.0
homepage: https://api.brazilayer.com/docs
metadata:
openclaw:
emoji: "🇧🇷"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
name: brazil-kyb
description: Verify any Brazilian company (CNPJ) with official data: registry status, partners, sanctions, bank licence, contracts, funds. Pay per call via x402.
version: 1.0.0
homepage: https://api.brazilayer.com/docs
metadata:
openclaw:
emoji: "🇧🇷"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
name: brazil-kyb
description: Verify any Brazilian company (CNPJ) with official data: registry status, partners, sanctions, bank licence, contracts, funds. Pay per call via x402.
version: 1.0.0
homepage: https://api.brazilayer.com/docs
metadata:
openclaw:
emoji: "🇧🇷"
This line instructs sending a CNPJ to a third-party API for validation. Even though a CNPJ is a company identifier rather than highly sensitive personal data, using the skill causes externally supplied user/business data to be transmitted off-platform to api.brazilayer.com, creating privacy, compliance, and trust-boundary risks if done without clear consent.
## Inputs
- **CNPJ**: 14 digits, with or without punctuation (`00.000.000/0001-91` = `00000000000191`).
Validate the check digits for free before paying: `GET https://api.brazilayer.com/v1/ferramentas/cnpj/<cnpj>`.
- If you only have a name, search first (paid, US$ 0.01):
`GET https://api.brazilayer.com/v1/cnpj/busca?q=<name>`.
This route sends a company name query to an external API. Names may reveal confidential supplier, customer, acquisition, or due-diligence targets, so this can expose business-sensitive information to a third party and trigger paid requests without sufficiently strong consent or data-classification guidance.
- **CNPJ**: 14 digits, with or without punctuation (`00.000.000/0001-91` = `00000000000191`).
Validate the check digits for free before paying: `GET https://api.brazilayer.com/v1/ferramentas/cnpj/<cnpj>`.
- If you only have a name, search first (paid, US$ 0.01):
`GET https://api.brazilayer.com/v1/cnpj/busca?q=<name>`.
## Free, no payment
This line again directs sending a CNPJ to an external service for validation. The context reduces severity somewhat because it recommends a free pre-check before paid calls, but it still normalizes sending user-supplied organizational data to a third party without discussing consent, retention, or jurisdictional/privacy implications.
## Free, no payment
- `GET https://api.brazilayer.com/v1/cnpj/amostra` and `/v1/integridade/amostra`: sample responses to see the shape.
- `GET https://api.brazilayer.com/v1/ferramentas/cnpj/<cnpj>`: check-digit validation only (does not say whether the company exists).
- `GET https://api.brazilayer.com/.well-known/x402`: every paid route with price.
## Paid routes (USDC on Base, via x402)
The example explicitly tells the agent to fetch a paid external endpoint, which can cause both external data disclosure and automatic payment side effects. The skill states payment is automatic with agentcash, so following this pattern without explicit authorization could leak business identifiers and spend funds, making the external transmission more dangerous than a normal read-only API example.
Base URL: https://api.brazilayer.com. Example:
fetch https://api.brazilayer.com/v1/empresa/enriquecer/00000000000191
No suspicious patterns detected.