Buy Anything

• Analyzed: May 12, 2026, 3:07 AM
• Findings: 1
• Version: 3.0.10
• Hash: 8a02431e13b3e729474673390e210c52c6e7719fc42f67834970d7ff527dd4d9
• Source: palm
• External report: View on VirusTotal

Findings (1)

The 'buy-anything' skill facilitates e-commerce purchases through the Rye API (api.rye.com) and BasisTheory payment vault. The instructions in SKILL.md demonstrate strong security awareness, specifically directing the agent to use quoted heredocs with curl to prevent shell injection, validating checkout IDs with regex, and explicitly warning the agent to ignore indirect prompt injection attempts from external product descriptions. The skill handles PII and payment tokens in a manner consistent with its stated purpose, utilizing external PCI-compliant capture pages to ensure raw card data never enters the agent's environment.