The Agent Procurement Playbook

• Outcome: Review
• Latest audit: May 28, 2026 · 2:06 PM UTC
• Version: 1.3.1

Overview

This is a non-executing procurement guide, but its copyable examples can initiate real payments and do not consistently enforce the spending controls the guide promises.

Install only as a guide and do not run the examples with production GreenHelix, wallet, or Stripe credentials until you have added a mandatory approval wrapper around every purchase path, confirmed sandbox endpoints, set hard budgets and vendor allowlists, and tested that threshold purchases cannot execute without human approval.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The guide explicitly states that no agent should bypass the approval gateway, but the provided example code later shows direct payment execution patterns that do not enforce that choke point. In a procurement skill, this inconsistency is dangerous because downstream implementers may copy the executable examples rather than the prose, allowing unauthorized or unreviewed spending outside policy controls.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The skill claims the policy engine evaluates every purchase before execution, yet the payment router and rail-specific purchase functions do not invoke policy evaluation or verify an approval token. This creates a design-level control bypass: anyone reusing these examples could route purchases directly to payment rails and defeat the stated spending controls, whitelists, escalation logic, and rate limits.

Ssd 3

Medium

• Confidence: 78% confidence
• Finding: The placeholder syntax suggests organizational and system identifiers may be interpolated into rendered content, which can leak internal metadata if populated from runtime context. In a skill distributed to users, unintended disclosure of organization names, system identifiers, or similar internal values can aid reconnaissance and may expose sensitive tenant-specific information.

External Transmission

Medium

• Category: Data Exfiltration

Content

def execute_tool(tool: str, input_data: dict) -> dict:
    """Execute a GreenHelix tool via the unified endpoint."""
    response = requests.post(
        f"{API_BASE}/v1",
        json={"tool": tool, "input": input_data},
        headers=headers,

• Confidence: 92% confidence
• Finding: The code sends structured input data to an external API endpoint, which is a real external transmission path. In this procurement context, those payloads may include vendor identifiers, purchasing metadata, workflow details, and potentially sensitive business information, so implementers could unintentionally exfiltrate procurement data to a third party.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

from typing import Optional

API_BASE = "https://api.greenhelix.net/v1"
headers = {"Authorization": f"Bearer {os.environ['GREENHELIX_API_KEY']}"}


def execute_tool(tool: str, input_data: dict) -> dict:

• Confidence: 94% confidence
• Finding: The code directly reads `GREENHELIX_API_KEY` from the environment and uses it for authenticated outbound requests. While environment-variable access is common, in a third-party skill this is sensitive because it normalizes credential harvesting from the host environment and couples secret access with external transmission, enabling real account actions if copied into an agent runtime.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Composite Score | Risk Level | Recommended Action |
|---|---|---|
| 0.80 - 1.00 | Low | Auto-approve up to per-transaction cap |
| 0.60 - 0.79 | Medium | Auto-approve for small amounts; escalate above $100 |
| 0.40 - 0.59 | High | Escalate all purchases for human review |
| 0.00 - 0.39 | Critical | Block. Do not purchase. |

• Confidence: 84% confidence
• Finding: The guide recommends automatic approval of some purchases based on risk scoring, which is genuine autonomous financial decision-making. In this specific skill context, that behavior is the core subject matter, but it still increases risk because scoring mistakes, adversarial vendor manipulation, or logic bugs can trigger unauthorized spend without human review.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Composite Score | Risk Level | Recommended Action |
|---|---|---|
| 0.80 - 1.00 | Low | Auto-approve up to per-transaction cap |
| 0.60 - 0.79 | Medium | Auto-approve for small amounts; escalate above $100 |
| 0.40 - 0.59 | High | Escalate all purchases for human review |
| 0.00 - 0.39 | Critical | Block. Do not purchase. |

• Confidence: 84% confidence
• Finding: This line extends the same autonomous approval concept to medium-risk purchases under certain amounts, which still creates real spending authority delegated to software. In a procurement playbook, the context makes it expected rather than malicious, but also more dangerous because readers are likely to operationalize the recommendations directly in financial workflows.

Static analysis

No suspicious patterns detected.