#1 Agent-to-Agent Marketplace

• Outcome: Review
• Latest audit: May 29, 2026 · 9:22 PM UTC
• Version: 1.0.1

Overview

This skill is a legitimate marketplace helper, but it can let an agent spend credits, share task details with third parties, run autonomously, and silently install a Python dependency at runtime.

Install only if you intentionally want an agent to use a Machins marketplace account. Require explicit approval before proposing, accepting, confirming, paying for, or auto-accepting trades; avoid sending secrets or sensitive data through tasks or deliveries; and prefer environments where the `machins` dependency is installed through a reviewed package process rather than by the script at runtime.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (7)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

from machins import Machins
    except ImportError:
        import subprocess
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "machins==0.1.0", "-q"],
            stdout=subprocess.DEVNULL,
        )

• Confidence: 94% confidence
• Finding: The code automatically invokes pip to install a package at runtime when the import fails. Even though the package name is pinned, executing package installation from a skill expands the attack surface, enables unexpected code execution during install/import, and bypasses normal dependency review and deployment controls.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill has self-install capability that is not essential to its core CLI behavior and causes code from an external package repository to be fetched and executed at runtime. In an agent skill context, this is more dangerous because installation may occur automatically in privileged or unattended environments.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The guidance says to search the marketplace first whenever the agent lacks a capability, which is broad enough to trigger third-party marketplace interactions for many generic requests. This can cause unnecessary data sharing, unreviewed vendor selection, and unintended spending or engagement with unknown agents without a clear user opt-in.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The 'fulfill' golden path says it searches, matches, and proposes a trade in one step, but the skill does not require an explicit warning or confirmation before creating that proposal. Because proposals can commit credits, expose task details to third parties, and begin a transaction flow, automatic proposal creation is risky without informed user approval.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The autonomous setup recommends `--auto-accept` for incoming trades and immediate event processing, but it lacks a strong warning that this delegates transactional decisions to unattended automation. An attacker or low-quality counterparty could exploit auto-acceptance to lock escrow, trigger unwanted work obligations, or induce costly/unsafe exchanges before a human reviews the request.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill silently installs a package without any warning or confirmation, denying the operator a chance to review network access, package provenance, or policy implications. In security-sensitive agent environments, silent dependency installation is risky because it can introduce unvetted code and side effects unexpectedly.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The registration flow prints the returned API key directly to stdout, which can expose credentials in terminal history, logs, orchestrator output, or other monitoring systems. In an agent marketplace context, leakage of an API key could allow unauthorized access to account actions, trades, wallet data, or other platform operations.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.