ClawHub
Back to skill

Security audit

Agent-to-Agent Commerce: Build Autonomous B2B Transactions

Security checks for vulnerabilities and agentic risk

Overview

This is a non-executable commerce guide, but it asks for more sensitive credentials than its examples need and includes copy-paste payment flows with under-scoped safeguards.

Review before installing. Use only sandbox or tightly scoped test credentials, do not provide a real Stripe key or long-lived agent signing key unless a specific example truly needs it, and add explicit production gates, spending limits, and recurring-subscription controls before adapting the payment flows.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:14
Finding

Unused High-Value Credentials Requested Beyond the Skill's Functional Requirements

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:151
Finding

Unpinned Third-Party Package Installation Creates Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:793
Finding

A2A Discovery Example Exposes an Unauthenticated HTTP Service on All Interfaces

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The notice states all examples use the GreenHelix sandbox and that no API key is required to get started, yet the subsequent curl and Python examples rely on Authorization: Bearer $GREENHELIX_API_KEY and os.environ["GREENHELIX_API_KEY"]. This is an active contradiction in the documentation about what is needed to use the examples.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guide includes deposit, escrow, and payment workflows without a strong, repeated warning that changing endpoints or credentials from sandbox to production could lock or transfer real funds. In a payments-focused skill, this context materially increases risk because users are encouraged to copy/paste operational financial code that can trigger irreversible transactions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

md
self,
        api_key: str,
        agent_id: str,
        base_url: str = "https://api.greenhelix.net/v1",
    ):
        self.base_url = base_url
        self.agent_id = agent_id

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 2921)May include surrounding context.

md
self,
        api_key: str,
        agent_id: str,
        base_url: str = "https://api.greenhelix.net/v1",
    ):
        self.base_url = base_url
        self.agent_id = agent_id

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 425)May include surrounding context.

Register Two Agents and Fund the Buyer

curl -- register the buyer agent:

bash
curl -s -X POST https://sandbox.greenhelix.net/v1 \

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 710)May include surrounding context.

md
def _register_resource(self, resource: dict):
        """Register a resource with the MCP registry."""
        import requests
        requests.post(
            f"{self.registry_url}/resources",
            json=resource,
            timeout=10,

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

This example creates escrow by sending authenticated payment instructions to an external service, and in a financial automation guide that action can directly lock funds. Although outbound traffic is expected, the context makes it security-relevant because the command is operational, copy/paste-ready, and insufficiently guarded against accidental production use.

Content

Scanner excerpt · SKILL.md (reported line 1261)May include surrounding context.

Standard escrow is the simplest pattern: the buyer locks funds, the seller does work, the buyer inspects the result and releases payment. If the work is unsatisfactory, the buyer can dispute or cancel.

curl -- create escrow:

bash
curl -s -X POST https://sandbox.greenhelix.net/v1 \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The subscription examples create recurring payment relationships but do not clearly emphasize that charges continue until cancellation. In a commerce automation guide, omission of that warning is risky because autonomous agents may create long-lived billing commitments that persist unnoticed.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 2622)May include surrounding context.

md
def greenhelix_tool(tool_name, input_data, api_key):
    """Generic GreenHelix tool call. Works with any framework."""
    response = requests.post(
        "https://sandbox.greenhelix.net/v1",
        headers={
            "Content-Type": "application/json",

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 2622)May include surrounding context.

md
def greenhelix_tool(tool_name, input_data, api_key):
    """Generic GreenHelix tool call. Works with any framework."""
    response = requests.post(
        "https://sandbox.greenhelix.net/v1",
        headers={
            "Content-Type": "application/json",

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The closing summary explicitly documents the API as POST /v1/{tool}, but the core AgentCommerce._execute implementation and all curl examples send requests to /v1 and specify the tool name in the JSON body. This is a direct documentation-to-code contradiction about the interface shape.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.