Agent Bazaar

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:34 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent guide for a paid external API marketplace, but it broadly encourages autonomous paid calls and sending user content to remote services without a clear per-call consent boundary.

Review this skill before installing if you use wallets or private project data. Use demo mode first, require explicit approval before every paid call, verify amount, recipient, network, endpoint, and cumulative spend, and do not send proprietary code, secrets, customer data, private URLs, or sensitive portfolio details unless you have intentionally approved that disclosure. Prefer pinned, local SDK installs over the documented global npm install.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/sdk-usage.md:7
• Finding: External Transmission of Potentially Sensitive Source Code Without Data-Safety Controls## Vulnerability Details **File Location**: `references/sdk-usage.md:7-19` **Vulnerability Type**: Sensitive information transmitted to an external service **Risk Level**: Medium ### Vulnerable Code ```python import requests # Step 1: Call without payment to discover requirements r = requests.post('https://agent-bazaar.com/api/x402/code-review', json={'code': 'print("hello")', 'language': 'python'}) if r.status_code == 402: payment_intent = r.json()['payment'] # Step 2: Delegate payment to lobster.cash wallet # lobster.cash handles: amount, currency, signing, broadcast # Step 3: Retry with payment proof from lobster.cash r = requests.post('https://agent-bazaar.com/api/x402/code-review', json={'code': 'print("hello")', 'language': 'python'}, headers={'X-402-Payment': payment_proof}) ``` ### Technical Analysis The documented integration transmits source code to `https://agent-bazaar.com`. Sending task data to this service is necessary for its remote code-review functionality, but the instructions do not establish safeguards to ensure that only the minimum required data is transmitted. In particular, the workflow does not require: - Explicit user approval before disclosing content to the external service. - Secret scanning or removal of credentials embedded in source files. - Exclusion of private keys, environment files, internal URLs, personal data, or proprietary material. - Disclosure of the service's data-retention and processing terms. - Selection of only the files or code fragments necessary for the requested analysis. The retry after payment sends the source code a second time. Other documented endpoints similarly accept arbitrary text, URLs, project descriptions, smart contracts, and portfolio information, so the disclosure risk is not limited to the code-review example. ### Attack Path 1. A user asks the agent to review a local or proprietary projec ...[truncated 1143 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit user authorization before sending any local content to `agent-bazaar.com`. 2. Display the destination, endpoint, selected files, data categories, and estimated cost before transmission. 3. Scan submitted content for secrets, private keys, access tokens, passwords, personal data, and internal endpoints. 4. Redact detected sensitive values and require separate confirmation if safe redaction is impossible. 5. Use an allowlist-based file selection process and exclude `.env` files, key stores, credential files, build artifacts, dependency directories, and version-control metadata by default. 6. Send only the smallest relevant code fragment rather than an entire repository. 7. Document the external service's privacy, retention, training, deletion, and subprocessors policies. 8. Warn users that demo mode still transmits task data unless the service explicitly guarantees otherwise. 9. Avoid duplicate submission when possible, or use a payment-discovery request that contains no sensitive task content.

T08 · Insecure Dependencies

Warning

• Location: references/sdk-usage.md:27
• Finding: Unpinned Third-Party SDK and Global CLI Installation## Vulnerability Details **File Location**: `references/sdk-usage.md:27` and `references/sdk-usage.md:85` **Vulnerability Type**: Unpinned third-party dependencies and unsafe global installation guidance **Risk Level**: Medium ### Vulnerable Code ```bash npm install @agentbazaar/x402-sdk ``` ```bash npm install -g agentbazaar ``` ### Technical Analysis The installation commands do not pin reviewed package versions or integrity values. Consequently, npm resolves whichever release is current when the command is executed. The effective code installed by users can therefore change after this Skill has been audited. The global CLI command further increases exposure by installing the package into the user's global npm environment. npm packages can execute lifecycle scripts during installation, and a compromised package, publisher account, transitive dependency, or future release could execute code with the privileges of the user running npm. No evidence establishes that either named package is currently malicious. The vulnerability is the absence of reproducible dependency controls and the recommendation to install a mutable package globally. ### Attack Path 1. An attacker compromises the package publisher, package registry entry, or a transitive dependency. 2. The attacker publishes a malicious version under the legitimate package name. 3. A user or agent follows the Skill documentation at a later date. 4. Because no version is pinned, npm resolves the malicious release. 5. npm installs the package and may execute attacker-controlled lifecycle scripts. 6. For the global CLI command, the malicious package is also placed in the user's global command environment and may be invoked in later sessions. ### Impact Assessment Malicious installation scripts execute with the operating-system privileges of the user running npm. Depending on those privileges, the attacker could read accessible files and environment variabl ...[truncated 411 chars]
• Remediation: ## Remediation Suggestions 1. Pin each package to a reviewed exact version, such as `package@x.y.z`, rather than accepting the latest release. 2. Commit and enforce a lockfile with verified integrity hashes. 3. Prefer a project-local installation over `npm install -g`. 4. Use `npm ci` in automated or reproducible environments. 5. Use `--ignore-scripts` where package functionality permits, and separately review any required lifecycle scripts. 6. Verify package ownership, provenance, signatures, and registry source before installation. 7. Audit direct and transitive dependencies with appropriate software-composition analysis tools. 8. Execute unfamiliar package tooling in an isolated container or restricted user environment without wallet credentials or unrelated secrets. 9. Document the expected package publisher, package checksum, reviewed version, and update procedure.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:59
• Finding: Real-Payment Workflow Lacks an Explicit Per-Transaction User Approval Boundary## Vulnerability Details **File Location**: `SKILL.md:59-74` **Vulnerability Type**: Insufficient authorization controls for delegated wallet payments **Risk Level**: Medium ### Vulnerable Instructions ```text ### Step 3: Pay and use 1. Pass the 402 payment requirements to lobster.cash 2. lobster.cash executes the payment and returns proof 3. Retry the request with the payment proof: curl -X POST https://agent-bazaar.com/api/x402/code-review \ -H "Content-Type: application/json" \ -H "X-402-Payment: <payment-proof-from-wallet>" \ -d '{"code": "function add(a,b) { return a + b }", "language": "javascript"}' ``` ### Technical Analysis The Skill correctly separates marketplace orchestration from wallet signing and states that `lobster.cash` owns transaction execution. However, it does not require explicit user approval of every real transaction before payment execution. The workflow accepts payment requirements supplied by the remote endpoint and passes them to the wallet. It does not mandate independent verification of the recipient, network, token, amount, capability, or whether the payment intent changed between requests. It also does not define a per-call limit, cumulative workflow budget, or maximum number of paid retries. Recommendations to inspect the HTTP 402 response or test in demo mode reduce risk but do not create an authorization boundary. This is especially relevant to documented chained workflows, where each remote call creates a separate payment. ### Attack Path 1. The agent invokes a paid endpoint and receives a server-controlled HTTP 402 payment intent. 2. The endpoint returns an unexpected amount or recipient, or the agent initiates more paid calls than the user anticipated. 3. The agent passes the payment intent to the configured wallet without presenting all transaction details for approval. 4. The wallet signs and broadcasts the transaction according to its own configuration. ...[truncated 732 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit user confirmation before every real payment. 2. Present the exact amount, currency, network, recipient, endpoint, purpose, and cumulative workflow cost before approval. 3. Default to demo mode and require a deliberate transition to real-payment mode. 4. Enforce wallet-side per-transaction, per-workflow, and per-session spending limits. 5. Independently validate that the payment recipient and amount match a trusted endpoint configuration. 6. Reject payment intents that change unexpectedly between discovery and execution. 7. Require fresh approval for retries, chained calls, price increases, recipient changes, or network changes. 8. Cap automatic retries and prevent a failed verification response from causing an automatic second payment. 9. Record a clear audit trail containing the approved intent, transaction identifier, result, and cumulative spend without logging sensitive payment proof. 10. Keep payment proof confidential and restrict its transmission to the intended HTTPS origin.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill description is extremely broad and can be invoked for many common agent tasks, including code review, content writing, scraping, image generation, trading signals, workflow integration, and payment handling. Over-broad routing increases the chance that this skill is selected in contexts involving sensitive data or real-money actions, expanding exposure to unnecessary third-party API calls and spend-capable workflows.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to perform paid transactions and send data to external services, but it does not require an explicit warning or consent flow covering both monetary spend and disclosure of potentially sensitive payloads to third parties. In an agent setting, this can lead to unapproved USDC spending and transmission of user data, code, or documents to external APIs.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Browse all capabilities
curl https://agent-bazaar.com/api/capabilities

# Filter by type or category
curl "https://agent-bazaar.com/api/capabilities?type=api&category=development"

• Confidence: 88% confidence
• Finding: The documented workflow directs the agent to query an external marketplace endpoint, which transmits user intent and possibly later task data to a third party. In this skill's context, that external transmission is coupled with a capability marketplace and payment flow, making it more dangerous because it can both leak metadata about user activity and steer the agent toward subsequent paid calls that may handle sensitive content.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: These endpoint descriptions invite users or agents to send research text, free-form content, and portfolio data over the network without warning that the payloads may contain sensitive or regulated information. Because this skill is designed for autonomous capability purchasing and invocation, the lack of disclosure can lead agents to transmit private business data, personal data, or financial holdings to external services by default.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The endpoint catalog encourages sending source code to remote analysis services but does not warn that submitted code may contain proprietary logic, secrets, credentials, or internal URLs. In a marketplace skill intended for autonomous agents, this omission increases the chance that sensitive material is exfiltrated to third-party infrastructure without informed user consent or sanitization.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation shows sending source code to a third-party remote endpoint for review without any warning about privacy, retention, or handling of potentially sensitive code. In an agent skill context, this can cause accidental exfiltration of proprietary code, secrets, or regulated data because users may copy the example directly and assume the call is safe.

External Transmission

Medium

• Category: Data Exfiltration

Content

import requests

# Step 1: Call without payment to discover requirements
r = requests.post('https://agent-bazaar.com/api/x402/code-review',
    json={'code': 'print("hello")', 'language': 'python'})

if r.status_code == 402:

• Confidence: 87% confidence
• Finding: This example performs an actual HTTPS POST to an external service and includes code content in the JSON body. While the transmission itself is expected product behavior, it is still security-relevant because it demonstrates exfiltration of potentially sensitive material to a remote service without surrounding safety guidance.

External Transmission

Medium

• Category: Data Exfiltration

Content

import requests

# Step 1: Call without payment to discover requirements
r = requests.post('https://agent-bazaar.com/api/x402/code-review',
    json={'code': 'print("hello")', 'language': 'python'})

if r.status_code == 402:

• Confidence: 87% confidence
• Finding: This example performs an actual HTTPS POST to an external service and includes code content in the JSON body. While the transmission itself is expected product behavior, it is still security-relevant because it demonstrates exfiltration of potentially sensitive material to a remote service without surrounding safety guidance.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Step 2: Delegate payment to lobster.cash wallet
    # lobster.cash handles: amount, currency, signing, broadcast
    # Step 3: Retry with payment proof from lobster.cash
    r = requests.post('https://agent-bazaar.com/api/x402/code-review',
        json={'code': 'print("hello")', 'language': 'python'},
        headers={'X-402-Payment': payment_proof})

• Confidence: 87% confidence
• Finding: This second POST retries the external request with a payment proof header, again transmitting code to a remote service and adding wallet/payment-related context. In an autonomous agent setting, this can combine data exfiltration with automatic spending, making misuse more consequential if guardrails are absent.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Step 2: Delegate payment to lobster.cash wallet
    # lobster.cash handles: amount, currency, signing, broadcast
    # Step 3: Retry with payment proof from lobster.cash
    r = requests.post('https://agent-bazaar.com/api/x402/code-review',
        json={'code': 'print("hello")', 'language': 'python'},
        headers={'X-402-Payment': payment_proof})

• Confidence: 87% confidence
• Finding: This second POST retries the external request with a payment proof header, again transmitting code to a remote service and adding wallet/payment-related context. In an autonomous agent setting, this can combine data exfiltration with automatic spending, making misuse more consequential if guardrails are absent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The CLI/SDK examples encourage direct use of marketplace skills but omit any notice that prompts, code, or other user-provided content may be transmitted to external third-party services. Because this skill is specifically designed to help agents discover and invoke remote capabilities autonomously, the missing disclosure increases the risk of silent data leakage during normal workflow use.

Static analysis

No suspicious patterns detected.