Security audit
Security checks for vulnerabilities and agentic risk
PurposeBot is a coherent commerce skill, but it enables real payment execution and on-chain settlement without strong built-in user confirmation guidance.
Review this skill carefully before installing it in an agent that has payment credentials. Use sandbox or low-limit credentials first, keep the private signing key in a secret manager, and require explicit human approval before any fund, confirm, execute, settle, refund, void, or dispute action.
- PURPOSEBOT_SIGNING_KID
- PURPOSEBOT_SIGNING_KEY_PEM
bins:
- curl
- jq
- python3
- openssl## API Basics - **Base URL:** `https://api.purposebot.ai/v1` - **Auth header:** `X-API-Key: $PURPOSEBOT_API_KEY` - All responses are JSON.
## API Basics - **Base URL:** `https://api.purposebot.ai/v1` - **Auth header:** `X-API-Key: $PURPOSEBOT_API_KEY` - All responses are JSON.
## API Basics - **Base URL:** `https://api.purposebot.ai/v1` - **Auth header:** `X-API-Key: $PURPOSEBOT_API_KEY` - All responses are JSON.
## API Basics - **Base URL:** `https://api.purposebot.ai/v1` - **Auth header:** `X-API-Key: $PURPOSEBOT_API_KEY` - All responses are JSON.
## API Basics - **Base URL:** `https://api.purposebot.ai/v1` - **Auth header:** `X-API-Key: $PURPOSEBOT_API_KEY` - All responses are JSON.
## API Basics - **Base URL:** `https://api.purposebot.ai/v1` - **Auth header:** `X-API-Key: $PURPOSEBOT_API_KEY` - All responses are JSON.
## API Basics - **Base URL:** `https://api.purposebot.ai/v1` - **Auth header:** `X-API-Key: $PURPOSEBOT_API_KEY` - All responses are JSON.
## API Basics - **Base URL:** `https://api.purposebot.ai/v1` - **Auth header:** `X-API-Key: $PURPOSEBOT_API_KEY` - All responses are JSON.
## API Basics - **Base URL:** `https://api.purposebot.ai/v1` - **Auth header:** `X-API-Key: $PURPOSEBOT_API_KEY` - All responses are JSON.
## API Basics - **Base URL:** `https://api.purposebot.ai/v1` - **Auth header:** `X-API-Key: $PURPOSEBOT_API_KEY` - All responses are JSON.
## API Basics - **Base URL:** `https://api.purposebot.ai/v1` - **Auth header:** `X-API-Key: $PURPOSEBOT_API_KEY` - All responses are JSON.
## API Basics - **Base URL:** `https://api.purposebot.ai/v1` - **Auth header:** `X-API-Key: $PURPOSEBOT_API_KEY` - All responses are JSON.
## API Basics - **Base URL:** `https://api.purposebot.ai/v1` - **Auth header:** `X-API-Key: $PURPOSEBOT_API_KEY` - All responses are JSON.
PY
)"
curl -s "https://api.purposebot.ai/v1/agents/identity/register" \
-H "X-API-Key: $PURPOSEBOT_API_KEY" \
-H "Content-Type: application/json" \
-d "{```bash
# Create a key with 90-day expiry
curl -s "https://api.purposebot.ai/v1/auth/producer/api-keys" \
-H "Cookie: <session>" \
-H "Content-Type: application/json" \
-d '{"expires_in_days": 90}' | jq .