Security audit
Private Agent Commerce Protocol
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent guide for building private agent commerce integrations and explicitly keeps wallet signing, private keys, and transaction broadcast outside the agent's control.
Before installing, confirm you actually want P-ACP commerce workflow support and review any npm packages it adds. The skill is designed to keep wallet approval and transaction broadcast in the consuming application, so do not provide seed phrases or private keys to any generated integration.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.