Security audit

Sardis Escrow

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed escrow-payment skill, but it deserves Review because it gives an agent live fund and release commands without clear approval, limit, or reversibility safeguards.

Install only after verifying the Sardis domain, API base path, and @sardis/sdk package. Use a sandbox or tightly scoped key with spending limits, and require manual confirmation before any create, fund, confirm-delivery, release, or milestone-release request. Treat every release as a potential real asset transfer.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill provides direct instructions to release escrowed funds and describes auto-release behavior, but does not include an explicit warning that these actions may be irreversible and can transfer assets permanently if triggered prematurely or based on unverified delivery claims. In an agent-invocable payment skill, that omission increases the chance of unsafe autonomous fund movement and user misunderstanding.

External Transmission

Medium

Category: Data Exfiltration
Content: # 2. Buyer funds the escrow echo "Funding escrow..." curl -X POST "https://api.sardis.sh/v2/escrow/$ESCROW_ID/fund" \ -H "Authorization: Bearer $SARDIS_API_KEY" \ -H "Content-Type: application/json" \ -d "{\"escrow_id\": \"$ESCROW_ID\", \"wallet_id\": \"wallet_buyer123\"}"
Confidence: 83% confidence
Finding: This workflow step funds the escrow through an authenticated POST and therefore can cause real asset movement. In a copy-pasteable 'complete workflow' section, the risk is amplified because users may execute the whole sequence without appreciating that this is not a harmless demo.

External Transmission

Medium

Category: Data Exfiltration
Content: ESCROW_ID=escrow_xyz789 # Release milestone 1 curl -X POST "https://api.sardis.sh/v2/escrow/$ESCROW_ID/release" \ -H "Authorization: Bearer $SARDIS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Confidence: 84% confidence
Finding: This milestone-release example performs a state-changing payout action and therefore carries genuine financial risk. In an autonomous payment context, documenting it as a simple command without explicit risk communication or approval constraints can lead to accidental partial disbursement.

External Transmission

Medium

Category: Data Exfiltration
Content: ```bash # Buyer deposits funds into escrow contract curl -X POST https://api.sardis.sh/v2/escrow/{escrow_id}/fund \ -H "Authorization: Bearer $SARDIS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Confidence: 82% confidence
Finding: This fund-escrow example is a state-changing authenticated external request tied to asset movement, not merely benign telemetry. In the context of a payment skill, exposing a straightforward funding command without conspicuous risk warnings or approval controls can cause unintended funding of contracts or misuse by automated agents.

External Transmission

Medium

Category: Data Exfiltration
Content: }' # Example: curl -X POST https://api.sardis.sh/v2/escrow/escrow_xyz789/fund \ -H "Authorization: Bearer $SARDIS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"escrow_id": "escrow_xyz789", "wallet_id": "wallet_buyer123"}'
Confidence: 82% confidence
Finding: This is another concrete example of a funding request using a real escrow path and API credential, which can cause actual monetary commitment. The danger comes from normalizing execution of a high-impact external financial action without robust user acknowledgment, especially in an agent automation context.

External Transmission

Medium

Category: Data Exfiltration
Content: ```bash # Buyer releases funds to seller after verification curl -X POST https://api.sardis.sh/v2/escrow/{escrow_id}/release \ -H "Authorization: Bearer $SARDIS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Confidence: 88% confidence
Finding: This release call is a direct authenticated instruction to transfer escrowed funds, making it a high-sensitivity action with real financial consequences. Without prominent warnings and approval controls, users or agents may execute it before proper verification, resulting in irreversible loss or dispute.

External Transmission

Medium

Category: Data Exfiltration
Content: }' # Partial release for milestone: curl -X POST https://api.sardis.sh/v2/escrow/escrow_xyz789/release \ -H "Authorization: Bearer $SARDIS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Confidence: 87% confidence
Finding: The milestone partial-release example is also a live money movement action and can prematurely disburse funds if used incorrectly. The skill context increases risk because it is designed for agent-to-agent payments, where automation may act on incomplete or spoofed milestone completion signals.

External Transmission

Medium

Category: Data Exfiltration
Content: # 2. Buyer funds the escrow echo "Funding escrow..." curl -X POST "https://api.sardis.sh/v2/escrow/$ESCROW_ID/fund" \ -H "Authorization: Bearer $SARDIS_API_KEY" \ -H "Content-Type: application/json" \ -d "{\"escrow_id\": \"$ESCROW_ID\", \"wallet_id\": \"wallet_buyer123\"}"
Confidence: 83% confidence
Finding: This workflow step funds the escrow through an authenticated POST and therefore can cause real asset movement. In a copy-pasteable 'complete workflow' section, the risk is amplified because users may execute the whole sequence without appreciating that this is not a harmless demo.

External Transmission

Medium

Category: Data Exfiltration
Content: # 5. Buyer verifies and releases echo "Releasing payment to seller..." curl -X POST "https://api.sardis.sh/v2/escrow/$ESCROW_ID/release" \ -H "Authorization: Bearer $SARDIS_API_KEY" \ -H "Content-Type: application/json" \ -d "{
Confidence: 89% confidence
Finding: This workflow includes a live release-payment command, which can complete a transfer to the seller. Embedding such a step in an end-to-end script without strong warnings or human approval checkpoints is dangerous because agents or operators may run it automatically and irreversibly disburse funds.

External Transmission

Medium

Category: Data Exfiltration
Content: ESCROW_ID=escrow_xyz789 # Release milestone 1 curl -X POST "https://api.sardis.sh/v2/escrow/$ESCROW_ID/release" \ -H "Authorization: Bearer $SARDIS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Confidence: 84% confidence
Finding: This milestone-release example performs a state-changing payout action and therefore carries genuine financial risk. In an autonomous payment context, documenting it as a simple command without explicit risk communication or approval constraints can lead to accidental partial disbursement.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.