Agentic Commerce — Lifestyle, Wellness, & Gifts

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:20 PM UTC
• Version: 1.0.12

Overview

The skill is not malicious, but it should be reviewed carefully because it can help agents make real cryptocurrency purchases and share shipping details, while some checkout instructions are not consistently gated by fresh user confirmation.

Install only if you are comfortable letting an agent interact with this store API for real purchases. Use it with a runtime that requires explicit approval before submitting shipping details, displaying payment addresses, signing wallet messages or transactions, or sending any crypto payment, and avoid enabling unattended spending unless you set a narrow budget and trust the merchant.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:188

Finding

Ambiguous authorization gates may allow cryptocurrency payment without fresh transaction confirmation

Content

View full analysis

" }) ``` **Response: 201 Created** with order confirmation and transaction signature. ``` `references/CHECKOUT-FIELDS.md:169-174`: ```markdown **After creating an order:** 1. Tell the user to send exactly `payment.amount` of `payment.token` to `payment.address` on `payment.chain`. 2. Display the QR code (`payment.qrCode`) if the client supports images. 3. Warn that the payment window expires at `expiresAt` (~15 minutes). 4. Begin polling `GET /orders/{orderId}/status` — every 5 seconds while `awaiting_payment`. ``` ### Technical Analysis The primary Skill contains a general requirement for explicit confirmation before payment, but the detailed x402 workflow proceeds directly from rece ...[truncated 2153 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:276

Finding

Untrusted API instructions may be relayed into agent output without semantic validation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The x402 flow explicitly supports agent-driven payment execution by having the agent construct and sign a USDC transfer, yet the documentation lacks a strong warning that using this endpoint can trigger autonomous on-chain fund movement. In a skill context for commerce automation, that omission is especially dangerous because an agent may interpret the flow as normal API usage rather than a high-risk irreversible financial action.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

md

## Critical rules

1. **Never request private keys or secrets.** Do not ask the user for private keys, seed phrases, or wallet secrets. Payment is made by the user (or runtime) from their own wallet; the skill only documents API endpoints and payment parameters.
2. **Product IDs are sacred.** Checkout **must** use the `id` from `/products/search` or `/products/{slug}`. Never fabricate, guess, or reuse example IDs.
3. **Payment window is ~15 minutes.** If it expires, the order is dead — create a new one.
4. **Verify chains/tokens first.** Call `GET /payment-methods` and use response `chains` before suggesting a payment method to the user.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The checkout API requires transmitting customer email and full shipping details to a third-party commerce endpoint, but the documentation does not instruct agents to obtain explicit user consent or warn that personal data will be shared externally. In an agentic setting, this omission can lead to silent exfiltration of personally identifiable information during purchase flows, especially if an agent treats checkout as a routine tool action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This documentation enables creation of real purchases and collection of sensitive personal and payment-related data, but it does not prominently require an explicit user confirmation or warn about the irreversible financial and privacy implications before checkout. In an agentic context, that increases the risk that an autonomous agent could proceed with ordering using stored or inferred data without sufficiently informed user consent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/CHECKOUT-FIELDS.md (reported line 90)May include surrounding context.

md

1. **Linked account** — The requester is authenticated and this wallet is linked to their account.
2. **Signed message** — Send `walletMessage` (from `GET /api/checkout/wallet-verify-message`) and `walletSignature` or `walletSignatureBase58` (the wallet’s signature of that message). Message is valid for 5 minutes.

If you send a wallet without verification, the API returns `400` with `code: "WALLET_VERIFICATION_REQUIRED"`. The response `discount` object shows the applied tier, percentage, and amount saved.

---

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 72% confidence

Finding

The phrase 'Offer to handle everything' encourages the agent to move from recommendation into end-to-end purchasing, including collecting shipping address and email and initiating checkout. Although the skill includes strong guardrails elsewhere, this wording still increases the chance of overbroad autonomous action and unnecessary collection of personal data if the runtime or agent applies it too aggressively.

Content

Scanner excerpt · SKILL.md (reported line 398)May include surrounding context.

md

1. **Ask** about the recipient — "Who's the gift for? Any interests, hobbies, or a budget in mind?"
2. **Search with intent** — use natural language like `gift for coffee lover under 50` or `cozy wellness gift`
3. **Present 2-3 curated picks** — include name, price, and a one-line reason why it's a good fit
4. **Offer to handle everything** — "Want me to order it? I just need a shipping address and your email."

Pro tip: Featured products (`GET /products/featured`) make excellent gift suggestions — they're curated and trending.

Static analysis

No suspicious patterns detected.