AgentOps: Managing AI Agent Fleets in Production

• Outcome: Review
• Latest audit: May 29, 2026 · 9:33 PM UTC
• Version: 1.3.1

Overview

This is a documentation-only skill, but its runnable examples are under-scoped for the real production API actions they demonstrate.

Review this carefully before installing or using it. Treat the code as live production-style sample code, not harmless sandbox material. Before running any snippet, verify the endpoint, use a limited test account and scoped API key, confirm billing and wallet effects, avoid sending sensitive tool inputs into audit or message records, and add dry-run, approval, rollback, and kill-switch controls around provisioning, disputes, SLA changes, routing, and persistent control loops.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The guide explicitly says examples work in a no-key sandbox, but the code consistently targets the production API endpoint and uses bearer-token authentication. This mismatch can mislead users into running state-changing production operations under the false assumption that they are harmless sandbox examples.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The file presents numerous code samples that perform live network calls and state-changing actions, yet the introduction frames the content as educational and non-executing. That omission materially increases the risk that an operator copies the code without understanding it can provision resources, spend funds, send messages, and alter compliance records.

External Transmission

Medium

• Category: Data Exfiltration

Content

```python
import requests

base_url = "https://api.greenhelix.net/v1"
api_key = "your-api-key"

session = requests.Session()

• Confidence: 94% confidence
• Finding: This code block sends authenticated requests to an external production API endpoint. In isolation external transmission is not always malicious, but here it is risky because the guide downplays execution risk while demonstrating a uniform wrapper for arbitrary remote tool invocation.

External Transmission

Medium

• Category: Data Exfiltration

Content

import uuid
import time

base_url = "https://api.greenhelix.net/v1"
api_key = "your-fleet-admin-key"

session = requests.Session()

• Confidence: 96% confidence
• Finding: This provisioning example performs external authenticated calls to register agents, create wallets, and build claim chains. Because these are state-changing and potentially billable operations against a live API, a copied example could create real assets and identities in production.

External Transmission

Medium

• Category: Data Exfiltration

Content

import requests
import time

base_url = "https://api.greenhelix.net/v1"
api_key = "your-api-key"

session = requests.Session()

• Confidence: 90% confidence
• Finding: The observability sample transmits agent identifiers and operational data to an external service. While expected for telemetry, it still constitutes live outbound data flow and may expose internal fleet metadata if users run it unchanged against real agents.

External Transmission

Medium

• Category: Data Exfiltration

Content

```python
import requests

base_url = "https://api.greenhelix.net/v1"
api_key = "your-api-key"

session = requests.Session()

• Confidence: 92% confidence
• Finding: The cost-tracking example makes live external calls to estimate cost, execute tools, and record transactions. This can directly trigger billable operations and ledger changes, making it more dangerous than a passive documentation snippet.

External Transmission

Medium

• Category: Data Exfiltration

Content

```python
import requests

base_url = "https://api.greenhelix.net/v1"
api_key = "your-api-key"

session = requests.Session()

• Confidence: 91% confidence
• Finding: The SLA code communicates with an external API to create contracts and monitor compliance, which can alter production state and governance records. In the context of misleading 'educational' framing, users may underestimate the operational consequences of running it.

External Transmission

Medium

• Category: Data Exfiltration

Content

```python
import requests

base_url = "https://api.greenhelix.net/v1"
api_key = "your-api-key"

session = requests.Session()

• Confidence: 92% confidence
• Finding: The scaling and routing section issues live external marketplace and upgrade calls, including best-match routing and agent tier changes. These operations can change workload distribution and cost profile in a real deployment if executed verbatim.

External Transmission

Medium

• Category: Data Exfiltration

Content

import hashlib
import json

base_url = "https://api.greenhelix.net/v1"
api_key = "your-api-key"

session = requests.Session()

• Confidence: 91% confidence
• Finding: The governance code sends auditable records and approval requests to an external API, potentially exposing sensitive action details, tool inputs, and compliance metadata. Because audit and oversight data can contain regulated or confidential content, live transmission here carries elevated risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

import time
import json

base_url = "https://api.greenhelix.net/v1"
api_key = "your-fleet-admin-key"

session = requests.Session()

• Confidence: 93% confidence
• Finding: The FleetCommander example centralizes continuous authenticated external control of provisioning, monitoring, SLA enforcement, and compliance reporting. This is effectively a production control-plane implementation, so publishing it as casual example code without strong execution warnings creates substantial risk of unintended live operations.

VirusTotal

57/57 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.