The Agent Testing & Observability Cookbook: Ship Reliable Agent Commerce Systems

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:43 AM UTC
• Version: 1.3.1

Overview

This non-executing GreenHelix guide is mostly purpose-aligned, but its reusable examples handle real API keys and payment actions with unsafe endpoint and CI secret patterns that need review before use.

Install only if you want a GreenHelix agent-commerce testing guide and are prepared to review the copied templates. Before using the examples with real credentials, restrict base_url to trusted GreenHelix hosts, avoid session-wide bearer headers across configurable origins, pass CI secrets through environment variables rather than inline source, pin dependencies, and redact or disable raw transaction input capture in production traces.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:168

Finding

API Credential Disclosure Through an Unvalidated Configurable Endpoint

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:2083

Finding

Unpinned Third-Party Dependencies Installed in CI

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:2192

Finding

GitHub Actions Secret Interpolated Directly into Shell-Executed Python Source

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1499)May include surrounding context.

md

tracer = AgentTracer(
            api_key="...",
            agent_id="production-buyer-01",
            base_url="https://api.greenhelix.net/v1",
        )

        # Wrap an existing AgentCommerce or harness

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1520)May include surrounding context.

md

tracer = AgentTracer(
            api_key="...",
            agent_id="production-buyer-01",
            base_url="https://api.greenhelix.net/v1",
        )

        # Wrap an existing AgentCommerce or harness

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 2364)May include surrounding context.

md

tracer = AgentTracer(
            api_key="...",
            agent_id="production-buyer-01",
            base_url="https://api.greenhelix.net/v1",
        )

        # Wrap an existing AgentCommerce or harness

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The guide explicitly recommends redacting sensitive inputs in production, but the AgentTracer implementation persists full input_data for every call in memory. In an agent-commerce context, inputs can include wallet amounts, agent identifiers, webhook URLs, and potentially secrets or PII, so this creates a real risk of sensitive-data exposure through logs, memory dumps, telemetry exports, or downstream debugging tooling.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The comment at L1956-L1963 states that HealthChecker delegates to the harness in test mode, but the actual HealthChecker class uses its own requests.Session and _timed_execute() posts directly to the network at L1836-L1846. This is a direct contradiction in the guide's inline documentation about how the class behaves under test.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:1800