agentcard.ai

• Risk level: Low
• Analyzed: Apr 6, 2026, 9:29 PM
• Findings: 0
• Version: 1.0.8

Overview

The skill's instructions, required artifacts, and configuration are coherent with its stated purpose (managing prepaid virtual Visa cards via a CLI), but it depends on installing a third‑party npm CLI and makes vendor claims that are not verifiable from the bundle—exercise caution and verify the upstream package before trusting it.

This skill appears to do what it says: it guides the agent to use an external 'agentcard' CLI to buy and manage prepaid Visa cards. Before installing or enabling it: 1) Verify the upstream npm package (https://www.npmjs.com/package/agentcard) — confirm the author/publisher, read package source, and check provenance/signatures if available. 2) Prefer manual installation and inspection of the CLI rather than allowing an agent to install global packages automatically. 3) Keep 'requireUserConfirmation' enabled and set a conservative maxPurchaseAmount so the agent cannot charge large amounts without explicit user approval. 4) Do not allow the agent to persist card details; follow the skill's advice to fetch card details on demand and only show them when the user explicitly requests them. 5) Because the skill bundle does not include a homepage/source in its metadata (and the plugin.json version differs from the registry metadata), treat vendor claims (Alchemy ownership, contact email) as unverified until you check the npm/package site and domain ownership. If you cannot verify the package publisher and code, consider this a higher risk and avoid granting the agent payment capabilities.