The Agent Procurement Playbook

Security checks across malware telemetry and agentic risk

Overview

This is a non-executing procurement guide, but its copyable examples can initiate real payments and do not consistently enforce the spending controls the guide promises.

Install only as a guide and do not run the examples with production GreenHelix, wallet, or Stripe credentials until you have added a mandatory approval wrapper around every purchase path, confirmed sandbox endpoints, set hard budgets and vendor allowlists, and tested that threshold purchases cannot execute without human approval.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The guide explicitly states that no agent should bypass the approval gateway, but the provided example code later shows direct payment execution patterns that do not enforce that choke point. In a procurement skill, this inconsistency is dangerous because downstream implementers may copy the executable examples rather than the prose, allowing unauthorized or unreviewed spending outside policy controls.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The skill claims the policy engine evaluates every purchase before execution, yet the payment router and rail-specific purchase functions do not invoke policy evaluation or verify an approval token. This creates a design-level control bypass: anyone reusing these examples could route purchases directly to payment rails and defeat the stated spending controls, whitelists, escalation logic, and rate limits.

Ssd 3

Medium
Confidence
78% confidence
Finding
The placeholder syntax suggests organizational and system identifiers may be interpolated into rendered content, which can leak internal metadata if populated from runtime context. In a skill distributed to users, unintended disclosure of organization names, system identifiers, or similar internal values can aid reconnaissance and may expose sensitive tenant-specific information.

External Transmission

Medium
Category
Data Exfiltration
Content
def execute_tool(tool: str, input_data: dict) -> dict:
    """Execute a GreenHelix tool via the unified endpoint."""
    response = requests.post(
        f"{API_BASE}/v1",
        json={"tool": tool, "input": input_data},
        headers=headers,
Confidence
92% confidence
Finding
requests.post( f"{API_BASE}/v1", json=

Env Variable Harvesting

High
Category
Data Exfiltration
Content
from typing import Optional

API_BASE = "https://api.greenhelix.net/v1"
headers = {"Authorization": f"Bearer {os.environ['GREENHELIX_API_KEY']}"}


def execute_tool(tool: str, input_data: dict) -> dict:
Confidence
94% confidence
Finding
os.environ['GREENHELIX_API_KEY']

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| Composite Score | Risk Level | Recommended Action |
|---|---|---|
| 0.80 - 1.00 | Low | Auto-approve up to per-transaction cap |
| 0.60 - 0.79 | Medium | Auto-approve for small amounts; escalate above $100 |
| 0.40 - 0.59 | High | Escalate all purchases for human review |
| 0.00 - 0.39 | Critical | Block. Do not purchase. |
Confidence
84% confidence
Finding
Auto-approve

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| Composite Score | Risk Level | Recommended Action |
|---|---|---|
| 0.80 - 1.00 | Low | Auto-approve up to per-transaction cap |
| 0.60 - 0.79 | Medium | Auto-approve for small amounts; escalate above $100 |
| 0.40 - 0.59 | High | Escalate all purchases for human review |
| 0.00 - 0.39 | Critical | Block. Do not purchase. |
Confidence
84% confidence
Finding
Auto-approve

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal