Agent Bazaar

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:34 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent guide for a paid external API marketplace, but it broadly encourages autonomous paid calls and sending user content to remote services without a clear per-call consent boundary.

Review this skill before installing if you use wallets or private project data. Use demo mode first, require explicit approval before every paid call, verify amount, recipient, network, endpoint, and cumulative spend, and do not send proprietary code, secrets, customer data, private URLs, or sensitive portfolio details unless you have intentionally approved that disclosure. Prefer pinned, local SDK installs over the documented global npm install.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/sdk-usage.md:7

Finding

External Transmission of Potentially Sensitive Source Code Without Data-Safety Controls

Content

View full analysis

Vulnerability Details

File Location: references/sdk-usage.md:7-19
Vulnerability Type: Sensitive information transmitted to an external service
Risk Level: Medium

Vulnerable Code

python

import requests

# Step 1: Call without payment to discover requirements
r = requests.post('https://agent-bazaar.com/api/x402/code-review',
    json={'code': 'print("hello")', 'language': 'python'})

if r.status_code == 402:
    payment_intent = r.json()['payment']
    # Step 2: Delegate payment to lobster.cash wallet
    # lobster.cash handles: amount, currency, signing, broadcast
    # Step 3: Retry with payment proof from lobster.cash
    r = requests.post('https://agent-bazaar.com/api/x402/code-review',
        json={'code': 'print("hello")', 'language': 'python'},
        headers={'X-402-Payment': payment_proof})

Technical Analysis

The documented integration transmits source code to https://agent-bazaar.com. Sending task data to this service is necessary for its remote code-review functionality, but the instructions do not establish safeguards to ensure that only the minimum required data is transmitted.

In particular, the workflow does not require:

• Explicit user approval before disclosing content to the external service.
• Secret scanning or removal of credentials embedded in source files.
• Exclusion of private keys, environment files, internal URLs, personal data, or proprietary material.
• Disclosure of the service's data-retention and processing terms.
• Selection of only the files or code fragments necessary for the requested analysis.

The retry after payment sends the source code a second time. Other documented endpoints similarly accept arbitrary text, URLs, project descriptions, smart contracts, and portfolio information, so the disclosure risk is not limited to the code-review example.

Attack Path

1. A user asks the agent to review a local or proprietary projec ...[truncated 1143 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user authorization before sending any local content to agent-bazaar.com.
2. Display the destination, endpoint, selected files, data categories, and estimated cost before transmission.
3. Scan submitted content for secrets, private keys, access tokens, passwords, personal data, and internal endpoints.
4. Redact detected sensitive values and require separate confirmation if safe redaction is impossible.
5. Use an allowlist-based file selection process and exclude .env files, key stores, credential files, build artifacts, dependency directories, and version-control metadata by default.
6. Send only the smallest relevant code fragment rather than an entire repository.
7. Document the external service's privacy, retention, training, deletion, and subprocessors policies.
8. Warn users that demo mode still transmits task data unless the service explicitly guarantees otherwise.
9. Avoid duplicate submission when possible, or use a payment-discovery request that contains no sensitive task content.

T08 · Insecure Dependencies

Warning

• Location: references/sdk-usage.md:27

Finding

Unpinned Third-Party SDK and Global CLI Installation

Content

View full analysis

Vulnerability Details

File Location: references/sdk-usage.md:27 and references/sdk-usage.md:85
Vulnerability Type: Unpinned third-party dependencies and unsafe global installation guidance
Risk Level: Medium

Vulnerable Code

bash

npm install @agentbazaar/x402-sdk

bash

npm install -g agentbazaar

Technical Analysis

The installation commands do not pin reviewed package versions or integrity values. Consequently, npm resolves whichever release is current when the command is executed. The effective code installed by users can therefore change after this Skill has been audited.

The global CLI command further increases exposure by installing the package into the user's global npm environment. npm packages can execute lifecycle scripts during installation, and a compromised package, publisher account, transitive dependency, or future release could execute code with the privileges of the user running npm.

No evidence establishes that either named package is currently malicious. The vulnerability is the absence of reproducible dependency controls and the recommendation to install a mutable package globally.

Attack Path

1. An attacker compromises the package publisher, package registry entry, or a transitive dependency.
2. The attacker publishes a malicious version under the legitimate package name.
3. A user or agent follows the Skill documentation at a later date.
4. Because no version is pinned, npm resolves the malicious release.
5. npm installs the package and may execute attacker-controlled lifecycle scripts.
6. For the global CLI command, the malicious package is also placed in the user's global command environment and may be invoked in later sessions.

Impact Assessment

Malicious installation scripts execute with the operating-system privileges of the user running npm. Depending on those privileges, the attacker could read accessible files and environment variabl ...[truncated 411 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each package to a reviewed exact version, such as package@x.y.z, rather than accepting the latest release.
2. Commit and enforce a lockfile with verified integrity hashes.
3. Prefer a project-local installation over npm install -g.
4. Use npm ci in automated or reproducible environments.
5. Use --ignore-scripts where package functionality permits, and separately review any required lifecycle scripts.
6. Verify package ownership, provenance, signatures, and registry source before installation.
7. Audit direct and transitive dependencies with appropriate software-composition analysis tools.
8. Execute unfamiliar package tooling in an isolated container or restricted user environment without wallet credentials or unrelated secrets.
9. Document the expected package publisher, package checksum, reviewed version, and update procedure.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:59

Finding

Real-Payment Workflow Lacks an Explicit Per-Transaction User Approval Boundary

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:59-74
Vulnerability Type: Insufficient authorization controls for delegated wallet payments
Risk Level: Medium

Vulnerable Instructions

text

### Step 3: Pay and use

1. Pass the 402 payment requirements to lobster.cash
2. lobster.cash executes the payment and returns proof
3. Retry the request with the payment proof:

curl -X POST https://agent-bazaar.com/api/x402/code-review \
  -H "Content-Type: application/json" \
  -H "X-402-Payment: <payment-proof-from-wallet>" \
  -d '{"code": "function add(a,b) { return a + b }", "language": "javascript"}'

Technical Analysis

The Skill correctly separates marketplace orchestration from wallet signing and states that lobster.cash owns transaction execution. However, it does not require explicit user approval of every real transaction before payment execution.

The workflow accepts payment requirements supplied by the remote endpoint and passes them to the wallet. It does not mandate independent verification of the recipient, network, token, amount, capability, or whether the payment intent changed between requests. It also does not define a per-call limit, cumulative workflow budget, or maximum number of paid retries.

Recommendations to inspect the HTTP 402 response or test in demo mode reduce risk but do not create an authorization boundary. This is especially relevant to documented chained workflows, where each remote call creates a separate payment.

Attack Path

1. The agent invokes a paid endpoint and receives a server-controlled HTTP 402 payment intent.
2. The endpoint returns an unexpected amount or recipient, or the agent initiates more paid calls than the user anticipated.
3. The agent passes the payment intent to the configured wallet without presenting all transaction details for approval.
4. The wallet signs and broadcasts the transaction according to its own configuration.

...[truncated 732 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation before every real payment.
2. Present the exact amount, currency, network, recipient, endpoint, purpose, and cumulative workflow cost before approval.
3. Default to demo mode and require a deliberate transition to real-payment mode.
4. Enforce wallet-side per-transaction, per-workflow, and per-session spending limits.
5. Independently validate that the payment recipient and amount match a trusted endpoint configuration.
6. Reject payment intents that change unexpectedly between discovery and execution.
7. Require fresh approval for retries, chained calls, price increases, recipient changes, or network changes.
8. Cap automatic retries and prevent a failed verification response from causing an automatic second payment.
9. Record a clear audit trail containing the approved intent, transaction identifier, result, and cumulative spend without logging sensitive payment proof.
10. Keep payment proof confidential and restrict its transmission to the intended HTTPS origin.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description is extremely broad and can be invoked for many common agent tasks, including code review, content writing, scraping, image generation, trading signals, workflow integration, and payment handling. Over-broad routing increases the chance that this skill is selected in contexts involving sensitive data or real-money actions, expanding exposure to unnecessary third-party API calls and spend-capable workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to perform paid transactions and send data to external services, but it does not require an explicit warning or consent flow covering both monetary spend and disclosure of potentially sensitive payloads to third parties. In an agent setting, this can lead to unapproved USDC spending and transmission of user data, code, or documents to external APIs.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The documented workflow directs the agent to query an external marketplace endpoint, which transmits user intent and possibly later task data to a third party. In this skill's context, that external transmission is coupled with a capability marketplace and payment flow, making it more dangerous because it can both leak metadata about user activity and steer the agent toward subsequent paid calls that may handle sensitive content.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

bash

# Browse all capabilities
curl https://agent-bazaar.com/api/capabilities

# Filter by type or category
curl "https://agent-bazaar.com/api/capabilities?type=api&category=development"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

These endpoint descriptions invite users or agents to send research text, free-form content, and portfolio data over the network without warning that the payloads may contain sensitive or regulated information. Because this skill is designed for autonomous capability purchasing and invocation, the lack of disclosure can lead agents to transmit private business data, personal data, or financial holdings to external services by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The endpoint catalog encourages sending source code to remote analysis services but does not warn that submitted code may contain proprietary logic, secrets, credentials, or internal URLs. In a marketplace skill intended for autonomous agents, this omission increases the chance that sensitive material is exfiltrated to third-party infrastructure without informed user consent or sanitization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation shows sending source code to a third-party remote endpoint for review without any warning about privacy, retention, or handling of potentially sensitive code. In an agent skill context, this can cause accidental exfiltration of proprietary code, secrets, or regulated data because users may copy the example directly and assume the call is safe.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

This example performs an actual HTTPS POST to an external service and includes code content in the JSON body. While the transmission itself is expected product behavior, it is still security-relevant because it demonstrates exfiltration of potentially sensitive material to a remote service without surrounding safety guidance.

Content

Scanner excerpt · references/sdk-usage.md (reported line 11)May include surrounding context.

md

import requests

# Step 1: Call without payment to discover requirements
r = requests.post('https://agent-bazaar.com/api/x402/code-review',
    json={'code': 'print("hello")', 'language': 'python'})

if r.status_code == 402:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

This example performs an actual HTTPS POST to an external service and includes code content in the JSON body. While the transmission itself is expected product behavior, it is still security-relevant because it demonstrates exfiltration of potentially sensitive material to a remote service without surrounding safety guidance.

Content

Scanner excerpt · references/sdk-usage.md (reported line 11)May include surrounding context.

md

import requests

# Step 1: Call without payment to discover requirements
r = requests.post('https://agent-bazaar.com/api/x402/code-review',
    json={'code': 'print("hello")', 'language': 'python'})

if r.status_code == 402:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

This second POST retries the external request with a payment proof header, again transmitting code to a remote service and adding wallet/payment-related context. In an autonomous agent setting, this can combine data exfiltration with automatic spending, making misuse more consequential if guardrails are absent.

Content

Scanner excerpt · references/sdk-usage.md (reported line 19)May include surrounding context.

md

# Step 2: Delegate payment to lobster.cash wallet
    # lobster.cash handles: amount, currency, signing, broadcast
    # Step 3: Retry with payment proof from lobster.cash
    r = requests.post('https://agent-bazaar.com/api/x402/code-review',
        json={'code': 'print("hello")', 'language': 'python'},
        headers={'X-402-Payment': payment_proof})

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

This second POST retries the external request with a payment proof header, again transmitting code to a remote service and adding wallet/payment-related context. In an autonomous agent setting, this can combine data exfiltration with automatic spending, making misuse more consequential if guardrails are absent.

Content

Scanner excerpt · references/sdk-usage.md (reported line 19)May include surrounding context.

md

# Step 2: Delegate payment to lobster.cash wallet
    # lobster.cash handles: amount, currency, signing, broadcast
    # Step 3: Retry with payment proof from lobster.cash
    r = requests.post('https://agent-bazaar.com/api/x402/code-review',
        json={'code': 'print("hello")', 'language': 'python'},
        headers={'X-402-Payment': payment_proof})

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The CLI/SDK examples encourage direct use of marketplace skills but omit any notice that prompts, code, or other user-provided content may be transmitted to external third-party services. Because this skill is specifically designed to help agents discover and invoke remote capabilities autonomously, the missing disclosure increases the risk of silent data leakage during normal workflow use.

Content

No source excerpt is available for this finding.