Agentic Supply Chain Orchestration

• Outcome: Review
• Latest audit: May 28, 2026, 2:09 PM
• Version:
  1.3.1

Overview

This is a non-executable guide, but it teaches production deployment of autonomous procurement, escrow, and payment workflows with under-scoped safety controls.

Review before installing or using. Treat the examples as reference code, not production-ready automation: run only in sandbox first, keep the GreenHelix API key in a secrets manager with least-privilege scope, require human approval for escrow/payment/order changes, and add enforceable budget, reroute-depth, cooldown, compliance, audit, and kill-switch controls before connecting it to real procurement systems.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide explicitly states the examples are 'production-ready' and tells users to 'copy the code, set your API key, and deploy' without any accompanying security guidance on credential scoping, secret storage, rotation, or avoiding logs and client-side exposure. In a skill that centers on automated procurement and payments, this encourages unsafe handling of a credential that grants read/write access to external commerce operations.

VirusTotal

No VirusTotal findings