Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Locking Down Agent Commerce: The OWASP-Aligned Security Guide for Autonomous AI Agents on GreenHelix
v1.3.1Locking Down Agent Commerce: The OWASP-Aligned Security Guide for Autonomous AI Agents on GreenHelix. Practical security hardening for AI agents handling rea...
⭐ 0· 97·0 current·0 all-time
by@mirni
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill is presented as a read-only, educational security guide that repeatedly states examples work with the GreenHelix sandbox and 'no API key required'. Despite that, the registry metadata declares three required environment variables (GREENHELIX_API_KEY, AGENT_SIGNING_KEY, STRIPE_API_KEY). Stripe and signing keys relate to commerce/identity and can be justified for a production hardening guide, but requiring them for a static guide that says sandbox usage is sufficient is incoherent and disproportionate.
Instruction Scope
SKILL.md explicitly says it does not execute code or install dependencies and that examples use a sandbox. The file also documents the three credentials as 'you supply these in your own environment'. However, the skill metadata will make those environment variables available to the agent at runtime. The instructions do not need those env vars to be present for the guide content itself, so embedding required credentials in the skill metadata expands runtime access unnecessarily and could enable accidental use or exfiltration.
Install Mechanism
No install spec and no code files are present — this is an instruction-only guide. That minimizes disk-install risk and is proportionate for a documentation/guide skill.
Credentials
Three environment variables are declared. GREENHELIX_API_KEY and STRIPE_API_KEY are directly related to commerce functionality; AGENT_SIGNING_KEY is relevant for agent identity. However: (1) the guide repeatedly says the sandbox does not require keys, and (2) requiring a private signing key and a live Stripe key in the skill metadata is excessive for a static guide and increases the risk of sensitive credential exposure. The skill doesn't justify why these credentials must be present in the environment for consumption by the agent itself.
Persistence & Privilege
always is false (default) and the skill is not requesting any system-wide configuration or other skills' credentials. No elevated persistence or system-wide changes are indicated.
What to consider before installing
This guide appears legitimate as documentation, but its registry metadata requests sensitive credentials that the guide itself says aren't required for sandbox examples. Before installing or providing any secrets: 1) Do not supply production Stripe or signing keys — use Stripe test keys and sandbox-only credentials. 2) Ask the publisher (or inspect SKILL.md) why these env vars are declared as required; there may be no technical need. 3) If you must provide keys, give minimal-scope, time-limited, and revocable credentials (e.g., Stripe restricted keys, read-only or scoped GREENHELIX keys), and store AGENT_SIGNING_KEY in a secure vault rather than the skill environment. 4) Prefer installing the skill in a restricted/test agent with no access to real funds. 5) Audit the guide's code examples locally rather than letting the agent execute them autonomously with live credentials. If the developer cannot justify why the skill needs these env vars present at runtime, treat the metadata as unnecessary and avoid supplying secrets.Like a lobster shell, security has layers — review code before you run it.
agent-securityvk975rfndhm01ryb91decabccbx84x71rai-agentvk975rfndhm01ryb91decabccbx84x71rcommercevk975rfndhm01ryb91decabccbx84x71rgreenhelixvk975rfndhm01ryb91decabccbx84x71rguidevk975rfndhm01ryb91decabccbx84x71rhardeningvk975rfndhm01ryb91decabccbx84x71rlatestvk975rfndhm01ryb91decabccbx84x71ropenclawvk975rfndhm01ryb91decabccbx84x71rowaspvk975rfndhm01ryb91decabccbx84x71rsecurityvk975rfndhm01ryb91decabccbx84x71r
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
EnvGREENHELIX_API_KEY, AGENT_SIGNING_KEY, STRIPE_API_KEY
Primary envGREENHELIX_API_KEY