Security audit
Security checks for vulnerabilities and agentic risk
This skill is a legitimate-looking virtual-card integration, but it gives agents broad payment-card powers without enough explicit safeguards.
Install only if you intend to let an agent manage real payment cards through Sardis. Configure a tightly scoped API key, require explicit human confirmation before card creation, reveal, unfreeze, limit increases, bulk freezes, or termination, and ensure full card numbers and CVVs are never printed, logged, stored, or returned to the model.
This is a user-invocable skill that can issue cards, reveal card data, freeze/unfreeze cards, and terminate cards, but it lacks clear activation boundaries or narrow trigger conditions. In an agent setting, ambiguous invocation criteria increase the chance of accidental or prompt-induced use of high-risk financial operations.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
env:
- SARDIS_API_KEY
bins:
- curl
- jq
primaryEnv: SARDIS_API_KEY
emoji: "💳"
The skill explicitly documents a reveal endpoint that returns full PAN and CVV, which are highly sensitive payment credentials. Even though the text warns not to log or display them, normal agent/tooling behavior may capture command output, traces, or model-visible responses, creating a real risk of credential exposure and unauthorized card use.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Endpoint Patterns
Base URL: `https://api.sardis.sh/v2`
### Issue Virtual Card
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Endpoint Patterns
Base URL: `https://api.sardis.sh/v2`
### Issue Virtual Card
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Endpoint Patterns
Base URL: `https://api.sardis.sh/v2`
### Issue Virtual Card
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Endpoint Patterns
Base URL: `https://api.sardis.sh/v2`
### Issue Virtual Card
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Endpoint Patterns
Base URL: `https://api.sardis.sh/v2`
### Issue Virtual Card
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Endpoint Patterns
Base URL: `https://api.sardis.sh/v2`
### Issue Virtual Card
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Endpoint Patterns
Base URL: `https://api.sardis.sh/v2`
### Issue Virtual Card
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Endpoint Patterns
Base URL: `https://api.sardis.sh/v2`
### Issue Virtual Card
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Endpoint Patterns
Base URL: `https://api.sardis.sh/v2`
### Issue Virtual Card
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Endpoint Patterns
Base URL: `https://api.sardis.sh/v2`
### Issue Virtual Card
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Endpoint Patterns
Base URL: `https://api.sardis.sh/v2`
### Issue Virtual Card
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Endpoint Patterns
Base URL: `https://api.sardis.sh/v2`
### Issue Virtual Card
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Endpoint Patterns
Base URL: `https://api.sardis.sh/v2`
### Issue Virtual Card
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## API Endpoint Patterns
Base URL: `https://api.sardis.sh/v2`
### Issue Virtual Card
The reveal endpoint transmits full payment credentials from the external service into the local execution and likely agent context. In agent environments, stdout capture, traces, retries, tool logs, or model reflection can expose the returned PAN/CVV, turning this external transmission into a meaningful sensitive-data handling vulnerability.
# Get full card details for use (SENSITIVE - log carefully)
curl -X GET https://api.sardis.sh/v2/cards/{card_id}/reveal \
-H "Authorization: Bearer $SARDIS_API_KEY"
# Response:
Unfreeze resumes spending capability, but the skill documents the action with no warning, confirmation, or authorization boundaries. In a user-invocable agent context, that makes an external action that restores financial access susceptible to accidental or manipulated execution.
# Unfreeze card (resume normal operation)
curl -X POST https://api.sardis.sh/v2/cards/{card_id}/unfreeze \
-H "Authorization: Bearer $SARDIS_API_KEY"
Updating spending limits is an external action that can materially increase the card's risk profile, yet the skill provides no confirmation or policy constraints around limit changes. In an agent setting, a prompt injection or mistaken invocation could silently expand purchasing authority.
# Modify card spending limits
curl -X PATCH https://api.sardis.sh/v2/cards/{card_id}/limits \
-H "Authorization: Bearer $SARDIS_API_KEY" \
-H "Content-Type: application/json" \
-d '{
The skill documents irreversible card termination but does not require a user warning, confirmation step, or safety gate. In a user-invocable agent workflow, a mistaken or manipulated invocation could permanently disrupt payments and operational continuity.
This external DELETE operation permanently terminates a card and is explicitly irreversible, but the skill presents it as a straightforward command without mandatory confirmation or safety controls. In a user-invocable financial skill, that creates real risk of destructive misuse or prompt-induced denial of service.
# Permanently close card (cannot be reversed)
curl -X DELETE https://api.sardis.sh/v2/cards/{card_id} \
-H "Authorization: Bearer $SARDIS_API_KEY" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
echo "ALERT: Multiple rapid transactions detected"
# Freeze card immediately
curl -X POST https://api.sardis.sh/v2/cards/$CARD_ID/freeze \
-H "Authorization: Bearer $SARDIS_API_KEY" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
echo "ALERT: Multiple rapid transactions detected"
# Freeze card immediately
curl -X POST https://api.sardis.sh/v2/cards/$CARD_ID/freeze \
-H "Authorization: Bearer $SARDIS_API_KEY" \
-H "Content-Type: application/json" \
-d '{
The skill instructs operators to always log card creation and transactions while also warning never to log full card numbers or CVVs and documenting a sensitive reveal flow. This inconsistency can lead implementers to over-log API responses or transaction data, especially in automated agent environments where raw outputs are commonly captured.
No suspicious patterns detected.