Autonomous Procurement Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:21 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its procurement purpose, but it combines autonomous purchasing decisions with weak license/auth controls and a network-facing webhook that need careful review before installation.

Install only in a controlled environment. Do not expose the webhook or /license endpoint publicly, do not set PROCU_ALLOWED_TIER outside local testing, and disable or wrap auto-approval behind your own verified requester, vendor-risk, spend-limit, and human-approval controls.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: auth-middleware.js:74

Finding

Spoofable User Identity and Fail-Open License Authorization

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: webhook-handler.js:272

Finding

Unauthenticated License Enumeration Endpoint

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: webhook-handler.js:217

Finding

Unbounded Webhook Request Buffering Enables Memory Exhaustion

Content

View full analysis

{ const chunks = []; req.on('data', c => chunks.push(c)); req.on('end', () => resolve(Buffer.concat(chunks))); req.on('error', reject); }); } ``` ```javascript if (req.method === 'POST' && url.pathname === '/webhook/lemon-squeezy') { const rawBody = await parseBody(req); const sig = req.headers['x-signature'] || ''; if (!verifySignature(rawBody, sig)) { ``` ### Technical Analysis The public webhook endpoint stores every incoming request chunk and concatenates the complete body before validating the HMAC signature. No maximum body size, streamed byte counter, request timeout, or early `Content-Length` rejection is implemented. Because signature verification occurs only after the body is fully buffered, an attacker does not need a valid Lemon Squeezy signature to consume memory. Multiple large or slowly transmitted requests can retain substantial buffers and open connections in the Node.js process. The wildcard CORS response is not the primary cause of this server-side denial-of-service condition; direct HTTP clients can exploit the endpoint regardless of browser policy. ### Attack Path 1. An attacker connects to the publicly reachable webhook endpoint. 2. The attacker sends a POST request to `/webhook/lemon-squeezy` with a very large body and either an invalid or absent `X-Signature`. 3. `parseBody()` appends every chunk to the in-memory `chunks` array. 4. The server does not reject the request until transmission ends and the full body is concatenated. 5. The attacker repeats the request concurrently or keeps multiple uploads slow and active. 6. Process memory and connection capacity are exhausted ...[truncated 494 chars]

Remediation

View remediation

{ const chunks = []; let total = 0; req.on('data', chunk => { total += chunk.length; if (total > maxBytes) { const error = new Error('Request body too large'); error.code = 'BODY_TOO_LARGE'; req.destroy(error); reject(error); return; } chunks.push(chunk); }); req.on('end', () => resolve(Buffer.concat(chunks, total))); req.on('error', reject); }); } ``` 4. Return HTTP 413 for oversized requests. 5. Configure server-level `requestTimeout`, `headersTimeout`, and connection limits. 6. Apply reverse-proxy request-size limits and per-source rate limiting. 7. Monitor rejected oversized requests and abnormal connection concurrency. 8. Preserve the exact accepted raw bytes for HMAC verification; do not parse or transform the body before validating the signature. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (36)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · PRIVACY.md (reported line 47)May include surrounding context.

数据删除

bash

rm -rf ~/.procurement-data/

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · PRIVACY.md (reported line 47)May include surrounding context.

数据删除

bash

rm -rf ~/.procurement-data/

---

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding indicates the advertised core capability may not exist while undeclared webhook/license-management behavior does. A deceptive or materially inaccurate description prevents informed review and can mask entirely different code paths, which is especially risky in procurement and finance contexts where trust, approval flow, and data handling are sensitive.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding indicates the advertised core capability may not exist while undeclared webhook/license-management behavior does. A deceptive or materially inaccurate description prevents informed review and can mask entirely different code paths, which is especially risky in procurement and finance contexts where trust, approval flow, and data handling are sensitive.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This file presents core policy content in Chinese, including data collection, fraud detection, and compliance sections, while not indicating that users can choose another language. Under the language/locale policy rule, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill requests or relies on environment-variable access and runtime capabilities but does not declare an explicit tool scope such as permissions or allowed-tools. That creates hidden capability expansion: an agent or reviewer may believe the skill is documentation-only procurement logic while it actually depends on sensitive runtime state like API keys and webhook secrets.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The documented output includes autonomous recommendations such as AUTO_APPROVED, REVIEW, and REJECT, indicating automated decision-making in a procurement/finance workflow. In this context, unsupervised approval logic can cause financial loss, blocked operations, or policy violations if parsing, baselines, or fraud heuristics are wrong or manipulated.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

md

"variant_detected": null,         // "V4" | "V8" | "V10" | null
  "anomaly_flags":   [],
  "fraud_flags":     [],
  "recommendation":  "AUTO_APPROVED", // "AUTO_APPROVED" | "REVIEW" | "REJECT"
  "safety_freeze":   false,
  "llm_error":       null
}

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 262)May include surrounding context.

For Claude Code, Codex, Copilot, or other agents:

bash

mkdir -p ~/.openclaw/skills/autonomous-procurement-agent
git clone https://github.com/arya-openclaw/autonomous-procurement-agent.git \
  ~/.openclaw/skills/autonomous-procurement-agent
cd ~/.openclaw/skills/autonomous-procurement-agent

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation simultaneously claims there is no production bypass for webhook signature validation while also documenting PROCU_ALLOWED_TIER as a bypass override. Contradictory guidance around signature enforcement is dangerous because deployers may accidentally leave a bypass enabled, allowing forged webhook events or unauthorized feature activation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Broad trigger keywords like generic procurement and approval terms can cause unintended activation during ordinary business discussions. In this skill's context, accidental activation is more dangerous because the skill is described as making blocking/review decisions, handling quote content, and invoking optional external processing, so false activation can affect sensitive finance workflows or leak data to fallback systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The auth flow transmits the user's email in an HTTP GET request to ${PROCU_WEBHOOK_URL}/license?email=<email> for license verification. This network transmission is described in code comments for developers, but there is no user-facing warning or explicit disclosure that user identity data is sent to a webhook service.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The middleware treats a Bearer header as a base64-encoded email string rather than a cryptographically verified authentication token. Any client can forge Authorization: Bearer <base64([e-mail])> and be authorized based on that user's license, enabling impersonation and bypass of feature gating.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation implies standard Bearer-token authentication, but the implementation only decodes base64 and performs no verification. This mismatch is dangerous because integrators may assume the route is protected when it is actually vulnerable to trivial spoofing, increasing the likelihood of insecure deployment.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

The skill explicitly advertises autonomous approval behavior: purchases under $10,000 are 'auto-approved instantly,' and higher-value requests enter an automated escalation path. In a finance/procurement setting, allowing an AI-driven workflow to authorize transactions without an explicit human checkpoint can enable fraudulent, erroneous, or policy-noncompliant purchases if parsing, thresholds, vendor data, or upstream inputs are manipulated.

Content

Scanner excerpt · listing.json (reported line 6)May include surrounding context.

json

"slug": "autonomous-procurement-agent",
  "tagline": "Zero-leak quote parsing with dual-engine AI. F1/F2/F3 fraud detection built in.",
  "shortDescription": "Enterprise procurement automation with hybrid dual-engine parsing (regex + GPT-4o), built-in F1/F2/F3 fraud detection, auto-escalation approval flows, Safety-Freeze circuit breakers, and Lemon Squeezy MoR payment.",
  "description": "The procurement agent that actually understands messy supplier quotes. Engine 1 (regex pipeline, ms response) handles structured JSON, HTML tables, and CSV. Engine 2 (GPT-4o LLM fallback) handles plain-text emails, OCR scans, and qty\u00d7price-on-same-line ambiguity.\n\n**Every result carries risk metadata:**\n- F1: unit_price \u00d7 quantity \u2260 line_total \u2192 calculation error detected, auto-block\n- F2: current price > historical avg \u00d7 1.20 \u2192 price spike flagged\n- F3: same vendor, same total, within 7 days \u2192 duplicate warning\n\n**Approval flow with Safety-Freeze:**\n- Under $10,000 limit: auto-approved instantly\n- Over limit: emails primary approver \u2192 5s timeout \u2192 escalates to backup\n- Both unreachable: Safety-Freeze + emergency alert + order locked\n\n**Lemon Squeezy MoR:** Global VAT/Sales Tax handled by LS. Payout via Payoneer/Wise/WorldFirst \u2014 no Stripe, no PayPal disputes.\n\n**Handles formats others can't:**\n- Email body: \"Servo motor SME-200: 8 units \u00d7 $2,800 = $22,400\" (qty and price on same line)\n- SAP-exported HTML with merged cells\n- Chinese RMB quotes auto-converted to USD\n- Multi-currency: CNY, EUR, GBP, JPY, AUD, CAD \u2192 normalized USD",
  "icon": "https://raw.githubusercontent.com/openclaw/clawhub/main/assets/procurement-icon.png",
  "iconBackground": "#E17055",
  "screenshots": [],

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The listing markets the skill as 'zero-leak' while also advertising a GPT-4o fallback for messy quotes, but it does not disclose what procurement data is transmitted to the external model, under what trigger conditions, or whether sensitive fields are redacted first. In a procurement/finance context, quote contents can include vendor identities, pricing, banking, and contract details, so undisclosed LLM egress creates a meaningful confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The features list reiterates an auto-approve workflow under a defined limit, confirming that autonomous financial decision-making is a core capability rather than incidental wording. Because the skill handles supplier quotes, fraud signals, and approval routing, a bad parse or adversarially crafted quote could directly influence whether money is committed or procurement controls are bypassed.

Content

Scanner excerpt · listing.json (reported line 77)May include surrounding context.

json

"F3 duplicate detection: same vendor + same total within 7 days",
    "Every result: confidence_score, risk_score, anomaly_flags, risk_alerts",
    "Currency normalizer: CNY/RMB/EUR/GBP/JPY/AUD/CAD \u2192 USD",
    "Approval flow: auto-approve under limit \u2192 email primary \u2192 escalate backup \u2192 Safety-Freeze",
    "Safety-Freeze: both approvers unreachable \u2192 emergency alert + order locked",
    "Lemon Squeezy MoR: global VAT handled, payouts via Payoneer/Wise/WorldFirst",
    "Zero hardcoded keys: all secrets from process.env"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list contains broad business phrases such as 'procurement', 'supplier quote', and 'vendor management' that are likely to match routine enterprise conversations. In a skill that can parse quotes, perform fraud/risk actions, and participate in approval/payment-related workflows, over-broad activation increases the chance of unintended invocation on sensitive financial data or accidental execution of procurement logic without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Procurement quotes can contain sensitive commercial pricing, vendor identities, and contact data. This code sends quote content to OpenAI whenever the regex pipeline fails or confidence is low, with no user-facing consent, policy gate, or tenant-level control beyond environment configuration; the regex masking is partial and can miss sensitive fields.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code invokes callLLMStructuredExtract from parseQuote, but that path calls callLLMSync, which always throws. In deployments with OPENAI_API_KEY set, malformed or low-confidence inputs consistently force the fallback path into failure, creating a reliable denial-of-service condition for messy documents and silently degrading fraud-review behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest emphasizes parsing, reconciliation, fraud detection F1/F2/F3, and approval thresholds, but the code adds general quote ranking via vendor/delivery scoring and duplicate detection workflows. Duplicate detection may align with the F3 mention, but vendor recommendation scoring is a broader sourcing/procurement optimization capability not described in the stated purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes quote parsing, invoice reconciliation, fraud detection, and approval escalation, but this file also includes Lemon Squeezy subscription tier mapping and webhook event handling. Billing/subscription management is a separate product capability and not an obvious implementation detail of procurement analysis itself.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · self-healing-parser.js (reported line 889)May include surrounding context.

js

// Safety-Freeze: circuit breaker open
    if (isApprovalCircuitOpen()) {
      result.status = 'SAFETY_FREEZE';
      result.action  = 'CIRCUIT_BREAKER_OPEN — no approvals sent, system in safety freeze';
      await sendEmergencyAlert('Safety Freeze: Approval circuit breaker is OPEN for order ' + orderId);
      return result;
    }

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The approval executor automatically approves orders below a configurable threshold with no human review, secondary verification, vendor risk check, or anti-abuse guard. In a procurement context, this can be exploited through invoice splitting, manipulated totals, or low-value fraudulent orders that bypass oversight and directly trigger financial commitments.

Content

Scanner excerpt · self-healing-parser.js (reported line 894)May include surrounding context.

js

return result;
    }

    // Under limit: auto-approve
    if (orderAmount <= approvalLimit) {
      result.status       = 'AUTO_APPROVED';
      result.finalApprover = 'SYSTEM_AUTO';

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The AUTO_APPROVED status reflects a real autonomous procurement decision, not just a label. Because the skill is positioned for enterprise finance and fraud detection, this behavior is more dangerous: users may rely on the system to block risky submissions, yet sub-threshold transactions can pass automatically despite parsing errors, fraud indicators, or manipulated order structuring.

Content

Scanner excerpt · self-healing-parser.js (reported line 896)May include surrounding context.

js

// Under limit: auto-approve
    if (orderAmount <= approvalLimit) {
      result.status       = 'AUTO_APPROVED';
      result.finalApprover = 'SYSTEM_AUTO';
      result.action        = 'Auto-approved: $' + orderAmount + ' <= $' + approvalLimit + ' limit';
      return result;

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The explicit action string shows the decision criterion is only orderAmount <= approvalLimit, which is too simplistic for autonomous spending authority. In this skill context, that is materially risky because the same system claims fraud detection and approval enforcement, so operators may overtrust automated approvals that can be gamed or applied to bad data.

Content

Scanner excerpt · self-healing-parser.js (reported line 898)May include surrounding context.

js

if (orderAmount <= approvalLimit) {
      result.status       = 'AUTO_APPROVED';
      result.finalApprover = 'SYSTEM_AUTO';
      result.action        = 'Auto-approved: $' + orderAmount + ' <= $' + approvalLimit + ' limit';
      return result;
    }