Agent-to-Agent Commerce: Build Autonomous B2B Transactions

• Outcome: Review
• Latest audit: May 29, 2026 at 9:33 PM UTC
• Version:
  1.3.1

Overview

This is a payment-integration guide, but it needs Review because copy-paste Python examples can reach a live payment API despite the guide saying examples use the sandbox.

Install only if you are intentionally studying or building GreenHelix payment integrations. Treat the examples as financially privileged: use sandbox/test credentials, explicitly set the sandbox base URL in Python examples, set spending caps before escrow or subscription workflows, and do not expose live Stripe, wallet, or signing keys to autonomous agents without tight limits and monitoring.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guide includes concrete subscription and deposit flows that can trigger recurring charges or movement of funds, but it does not place strong, explicit warnings immediately around those examples about real financial side effects. In an agent-skill context, examples that normalize automated recurring payments without prominent safeguards can lead operators to incur unintended charges or authorize risky unattended spending.

VirusTotal

66/66 vendors flagged this skill as clean.