Agent Bazaar

• Outcome: Review
• Latest audit: May 29, 2026 · 9:28 PM UTC
• Version: 1.0.0

Overview

This is a coherent Agent Bazaar guide, but it gives agents a path to spend real USDC and send user data to remote services without enough approval and privacy guardrails.

Review before installing. Use demo mode first, require manual approval for every real payment, set a strict per-task budget, and do not submit secrets, private keys, proprietary source code, unreleased contracts, regulated data, or sensitive portfolio details unless that disclosure is explicitly approved.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The manifest description contains very broad activation cues such as helping when an agent needs to find capabilities, browse/search a marketplace, understand payment flow, evaluate pricing, or chain skills together. This can cause the skill to activate on many generic requests, increasing the chance that payment-oriented or external-network behavior is introduced into conversations where it was not specifically requested.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The catalog encourages sending source code, research text, scraped content, and other potentially sensitive inputs to third-party remote endpoints without any privacy, retention, or data-handling warning. In this skill context, agents may autonomously forward proprietary code, secrets, internal documents, or personal data to external services, creating confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The file states that all x402 endpoints accept a payment proof and that payment execution is delegated to a wallet, but it does not clearly warn that invoking these endpoints may trigger real wallet-based spending. In an autonomous-agent marketplace context, this is especially risky because an agent could make repeated paid calls or chain tools together without clear operator awareness, causing unintended financial loss.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The examples explicitly send user-supplied code to a third-party remote service but provide no warning about confidentiality, data handling, or the risk of uploading proprietary or sensitive source code. In a security-sensitive context, developers may copy these snippets directly and unintentionally disclose internal code, secrets embedded in code, or regulated data to an external vendor.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document instructs an agent to submit payment proofs via headers and to delegate payment execution to an external wallet, but it does not warn that this may trigger real spending or that payment artifacts are being transmitted to third-party services. In an autonomous-agent marketplace context, that omission increases the chance of unintended charges, unsafe retry behavior, or leakage/replay of payment credentials if agents treat demo and real flows interchangeably.

External Transmission

Medium

• Category: Data Exfiltration

Content

import requests

# Step 1: Call without payment to discover requirements
r = requests.post('https://agent-bazaar.com/api/x402/code-review',
    json={'code': 'print("hello")', 'language': 'python'})

if r.status_code == 402:

• Confidence: 83% confidence
• Finding: requests.post('https://

External Transmission

Medium

• Category: Data Exfiltration

Content

# Step 2: Delegate payment to lobster.cash wallet
    # lobster.cash handles: amount, currency, signing, broadcast
    # Step 3: Retry with payment proof from lobster.cash
    r = requests.post('https://agent-bazaar.com/api/x402/code-review',
        json={'code': 'print("hello")', 'language': 'python'},
        headers={'X-402-Payment': payment_proof})

• Confidence: 84% confidence
• Finding: requests.post('https://

External Transmission

Medium

• Category: Data Exfiltration

Content

import requests

# Step 1: Call without payment to discover requirements
r = requests.post('https://agent-bazaar.com/api/x402/code-review',
    json={'code': 'print("hello")', 'language': 'python'})

if r.status_code == 402:

• Confidence: 83% confidence
• Finding: requests.post('https://agent-bazaar.com/api/x402/code-review', json=

External Transmission

Medium

• Category: Data Exfiltration

Content

# Step 2: Delegate payment to lobster.cash wallet
    # lobster.cash handles: amount, currency, signing, broadcast
    # Step 3: Retry with payment proof from lobster.cash
    r = requests.post('https://agent-bazaar.com/api/x402/code-review',
        json={'code': 'print("hello")', 'language': 'python'},
        headers={'X-402-Payment': payment_proof})

• Confidence: 84% confidence
• Finding: requests.post('https://agent-bazaar.com/api/x402/code-review', json=

VirusTotal

59/59 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.