Agent Threat Intelligence Exchange

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:28 AM UTC
• Version: 1.3.1

Overview

This is a non-executable guide, but it describes autonomous live marketplace actions involving payments, SLAs, disputes, and sensitive threat-intelligence data with inconsistent safety framing and flawed access-control examples.

Treat this as a Review item before installation or use. Do not let an agent run these examples against a real GreenHelix account or real threat-intelligence data without explicit endpoint selection, test-mode confirmation, budget limits, legal/compliance review, and independent fixes for the shown authorization checks.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:843

Finding

Noncompliant subscriptions can retain unauthorized lower-tier feed access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 843-849
Vulnerability Type: Broken authorization and access-control validation
Risk Level: High

Vulnerable Code:

python

if terms.get("tier") == tier and compliance.get("compliant", False):
    has_access = True
    active_tier = tier
elif terms.get("tier") == "premium" and tier in ("professional", "community"):
    # Premium subscribers get access to lower tiers
    has_access = True
    active_tier = terms.get("tier")
elif terms.get("tier") == "professional" and tier == "community":
    has_access = True
    active_tier = terms.get("tier")

Technical Analysis

The exact-tier authorization branch requires the SLA compliance result to be true. However, the two branches that grant inherited access to lower tiers do not check the compliance result.

Consequently, an account whose recorded SLA tier is premium or professional can receive lower-tier access even if check_sla_compliance reports that the associated SLA is noncompliant. Depending on the platform's compliance semantics, noncompliance could represent an expired, unpaid, suspended, or otherwise invalid subscription.

This is a broken authorization condition: entitlement level and entitlement validity must both be verified before access is granted. A higher recorded tier must not independently establish authorization.

Attack Path

1. A consumer obtains or retains an SLA record whose tier is premium or professional.
2. The SLA subsequently becomes noncompliant.
3. The consumer requests access to a lower-tier feed.
4. check_sla_compliance returns the SLA data with compliant set to false.
5. The exact-tier branch is skipped, but a lower-tier inheritance branch matches the recorded tier.
6. The function returns has_access: True.
7. A provider relying on this result may deliver threat-intelligence data without a currently valid entitlement.

Impact

...[truncated 584 chars]

Remediation

View remediation

Remediation Suggestions

Require a valid compliance result before evaluating any tier entitlement:

python

is_compliant = compliance.get("compliant") is True
if not is_compliant:
    return {
        "has_access": False,
        "active_tier": None,
        "requested_tier": tier,
        "sla_compliant": False,
    }

subscribed_tier = terms.get("tier")
tier_access = {
    "community": {"community"},
    "professional": {"professional", "community"},
    "premium": {"premium", "professional", "community"},
}

has_access = tier in tier_access.get(subscribed_tier, set())

Additionally:

1. Validate that the SLA belongs to the expected consumer and provider.
2. Verify that its status is active and that its expiration time has not passed.
3. Verify payment or escrow state independently where applicable.
4. Fail closed when the compliance response is missing, malformed, or ambiguous.
5. Add tests for expired, unpaid, suspended, and noncompliant higher-tier subscriptions requesting lower-tier content.
6. Perform authorization again at the point of delivery rather than relying only on an earlier check.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:1282

Finding

Empty recipient authorization lists bypass restricted TLP access controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 1282-1295
Vulnerability Type: Fail-open authorization for restricted intelligence
Risk Level: High

Vulnerable Code:

python

if tlp_level in ("TLP:AMBER+STRICT", "TLP:RED"):
    # These levels require explicit recipient authorization
    sla_check = self.execute("check_sla_compliance", {
        "agent_id": provider_id,
        "consumer_id": consumer_id,
    })
    sla_terms = sla_check.get("sla", {}).get("terms", {})
    authorized_recipients = sla_terms.get("authorized_agent_ids", [])
    if consumer_id not in authorized_recipients and authorized_recipients:
        issues.append({
            "type": "tlp_violation",
            "detail": f"Consumer {consumer_id} not in authorized "
                      f"recipients for {tlp_level}",
        })

Technical Analysis

The code states that TLP:AMBER+STRICT and TLP:RED require explicit recipient authorization. Nevertheless, it records a violation only when both of the following conditions are true:

1. The consumer is absent from authorized_recipients.
2. authorized_recipients is nonempty.

When authorized_agent_ids is absent, the default is an empty list. Because an empty list is false in Python, the condition does not add a violation. The same bypass occurs when the field is explicitly present but empty.

The final compliance result is based on whether non-warning issues were recorded. Therefore, a missing authorization configuration can be treated as compliant even though no consumer was explicitly authorized. Restricted classifications should use fail-closed authorization: absence of an allowlist must deny delivery.

Attack Path

1. A restricted STIX bundle is classified as TLP:AMBER+STRICT or TLP:RED.
2. The associated SLA omits authorized_agent_ids, provides an empty list, or otherwise yields no authorized recipients.
3. A consumer requests deli ...[truncated 881 chars]

Remediation

View remediation

Remediation Suggestions

Treat a missing, empty, or malformed allowlist as an authorization failure:

python

authorized_recipients = sla_terms.get("authorized_agent_ids")

if (
    not isinstance(authorized_recipients, list)
    or not authorized_recipients
    or consumer_id not in authorized_recipients
):
    issues.append({
        "type": "tlp_violation",
        "detail": (
            f"Consumer {consumer_id} lacks explicit authorization "
            f"for {tlp_level}"
        ),
    })

Further hardening should include:

1. Require sla_check.get("compliant") is True before accepting the SLA as an authorization source.
2. Verify that the SLA belongs to the expected provider and consumer.
3. Validate agent identifiers using a strict schema and exact canonical comparison.
4. Reject unsupported or malformed TLP values instead of treating them as unrestricted.
5. Separate warnings from blocking violations and require an explicit positive authorization result before delivery.
6. Add tests covering missing lists, empty lists, malformed lists, unauthorized consumers, expired SLAs, and correctly authorized consumers.
7. Enforce the same recipient check at the final data-delivery boundary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The guide repeatedly encourages live use of marketplace operations that create wallets, deposits, escrow, SLAs, and disputes against a real external API, but it does not provide a prominent warning about financial, legal, or operational consequences. In an autonomous-agent context, this is dangerous because users may run example flows assuming they are harmless demos and unintentionally trigger real transactions or workflow side effects.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The code is designed to transmit data to https://api.greenhelix.net/v1, including agent identifiers, API keys via bearer auth, marketplace activity, and potentially sensitive threat-intelligence content. In a threat-intel skill, external transmission is contextually significant because STIX bundles, IOC metadata, dispute evidence, and compliance records may contain sensitive operational data whose disclosure, jurisdiction, or trust assumptions are not fully bounded in the guide.

Content

Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.

md

self,
        api_key: str,
        agent_id: str,
        base_url: str = "https://api.greenhelix.net/v1",
    ):
        self.api_key = api_key
        self.agent_id = agent_id

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The surrounding documentation says the scorer measures accuracy, freshness, coverage, false positive rate, and delivery reliability, and Chapter 4 presents those as the trust model. In actual code, score_delivery only derives median age, average confidence, validity percentage, and a freshness score; it does not calculate accuracy, coverage, false positive rate, or delivery reliability. This is an active doc/code contradiction, not mere incompleteness.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The text explicitly states the consumer agent enforces minimum reputation thresholds in its find_best_provider logic before ranking providers. However, the implementation at L0465-L0477 simply passes the requirements dict to best_match and performs no local reputation filtering or verification. That is a direct contradiction between documentation and code behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The documentation explicitly states that every method calls the GreenHelix REST API and that agents can run the code autonomously, confirming routine external transmission and remote action against a third-party service. Because this skill is about automated threat-intel commerce, the operational context makes the transmission more sensitive: autonomous outbound calls may expose SOC telemetry, trading behavior, budgets, and compliance artifacts to an external platform.

Content

Scanner excerpt · SKILL.md (reported line 1613)May include surrounding context.

md

Every class inherits from `GreenHelixClient`. Every method calls the REST API (`POST /v1/{tool}`) with a specific tool name. Every pattern is designed for autonomous execution -- your SOC agents can run this code without human intervention, making purchase decisions, quality assessments, and dispute filings based on the policies you set.

For the full GreenHelix API reference (all 128 tools across 15 service categories), visit [https://api.greenhelix.net/docs](https://api.greenhelix.net/docs).

---

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The closing summary states that Chapter 8 provided MarketplaceMonitor and MarketplaceBudgetController plus production operations features. No Chapter 8 appears in this file, and no such classes are defined anywhere in the provided content. This is a clear documentation-to-content contradiction.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:1196