Agentic Commerce - Buy IRL Items With USDC

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:08 AM UTC
• Version: 1.0.1

Overview

The skill matches a crypto-shopping purpose, but it needs review because it asks for raw wallet private keys and can submit irreversible payments without a clear transaction-review step.

Review carefully before installing or using with real funds. Prefer browser checkout or a trusted wallet/hardware-wallet flow, do not pass a main wallet private key on the command line, and test only with a dedicated low-balance wallet. Before paying, independently verify the merchant, amount, chain, recipient/contract, fees, and the personal shipping data sent to api.purch.xyz.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly performs network operations against a third-party API but does not declare permissions or otherwise surface that capability in a machine-enforceable way. Hidden or undeclared network access is risky because an agent may transmit user prompts, PII, order details, or wallet-related data to an external service without an explicit trust boundary.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill describes collecting email, shipping address, and wallet information and then signing/submitting blockchain payments, but it does not require an explicit user warning or confirmation for privacy exposure and irreversible financial actions. In this context, users could unintentionally authorize fund transfers or disclose sensitive personal data to a remote service without understanding the consequences.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script sends highly sensitive personal data including email address, full shipping address, and wallet address to a remote third-party API, but it does not clearly warn the user that this data will be transmitted off-host. In a purchasing and crypto-checkout context, that data can be privacy-sensitive, link a real-world identity to a blockchain wallet, and increase the consequences of accidental or uninformed disclosure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script sends sensitive personal data including email address, wallet address, and full shipping address to a third-party remote API endpoint without any explicit warning, consent prompt, or minimization notice to the user at the point of execution. In a shopping context this transmission may be functionally necessary, but the lack of clear disclosure increases privacy and compliance risk and could surprise users or downstream operators embedding this script into larger agents.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script accepts a Base58 private key directly via the --private-key command-line argument, which exposes sensitive material through shell history, process listings, audit logs, and CI job output. In a purchasing and transaction-signing skill, this is especially dangerous because compromise of the key can lead to unauthorized signing and loss of funds beyond the immediate purchase.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The script signs and immediately broadcasts a blockchain transaction returned by a remote API without an explicit user confirmation step or a clear display of the exact transaction details being authorized. In this skill context, where the tool creates real purchase orders and submits on-chain payments, a malicious or compromised API response could cause unintended transfers or purchases with little opportunity for the user to detect them.

Missing User Warnings

High

• Confidence: 93% confidence
• Finding: The script accepts a raw Solana private key on the command line and uses it directly to sign a transaction, but it does not present a clear safety warning or safer alternative. Command-line secrets are commonly exposed through shell history, process listings, terminal logs, and CI output, which can lead to full wallet compromise and loss of funds.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The createOrder request sends email, wallet address, and shipping address to https://api.purch.xyz, which is expected for the feature but is done without an explicit user-facing disclosure in the tool flow. Because this skill handles purchasing, the context increases sensitivity: users may unknowingly transmit personally identifiable information to a third-party service.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: After receiving a serialized transaction from the external purch API, the script immediately signs and broadcasts it without showing the transaction details or requiring a confirmation step. In this skill context, that is particularly dangerous because the remote service effectively controls what the user signs; a malicious or compromised API could return a transaction that transfers unexpected assets or authorizes harmful on-chain actions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The function sends the user's free-form shopping query and optional structured context directly to an external service at api.purch.xyz without any notice, consent flow, or indication in the CLI output that data leaves the local environment. This creates a real privacy and data-handling risk because users may include sensitive preferences, personal details, or purchase intent in natural-language input, and the skill context explicitly centers on e-commerce and checkout workflows where such data can be commercially sensitive.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script requires a Solana private key to be passed as a positional command-line argument, which exposes sensitive material through shell history, process listings, audit logs, and CI/CD job output. In the context of a shopping and crypto checkout skill that signs live blockchain transactions, compromise of this key can directly enable unauthorized spending from the user's wallet.

External Transmission

Medium

• Category: Data Exfiltration

Content

const { products, reply } = await searchResponse.json();

// 2. User selects a product, create order (Solana wallet)
const orderResponse = await fetch("https://api.purch.xyz/buy", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({

• Confidence: 92% confidence
• Finding: fetch("https://api.purch.xyz/buy", { method: "POST"

External Transmission

Medium

• Category: Data Exfiltration

Content

const { products } = await searchResponse.json();

// 2. User selects a product, create order (EVM wallet)
const orderResponse = await fetch("https://api.purch.xyz/buy", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({

• Confidence: 92% confidence
• Finding: fetch("https://api.purch.xyz/buy", { method: "POST"

External Transmission

Medium

• Category: Data Exfiltration

Content

const { products, reply } = await searchResponse.json();

// 2. User selects a product, create order (Solana wallet)
const orderResponse = await fetch("https://api.purch.xyz/buy", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({

• Confidence: 92% confidence
• Finding: https://api.purch.xyz/

External Transmission

Medium

• Category: Data Exfiltration

Content

const { products } = await searchResponse.json();

// 2. User selects a product, create order (EVM wallet)
const orderResponse = await fetch("https://api.purch.xyz/buy", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({

• Confidence: 92% confidence
• Finding: https://api.purch.xyz/

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.