Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-03
This skill is documentation-only: it tells the agent how to look up Brazilian company data (CNPJ registry status, partners, sanctions lists, bank licences, government contracts, investment funds) from a single third-party API, api.brazilayer.com. There is no executable code, no scripts, and no credentials or environment variables involved. Most endpoints cost money — micro-payments in USDC on the Base network via the x402 protocol, paid automatically if the agent uses an 'agentcash'-style wallet tool — with listed prices from US$0.001 to US$0.05 per call. That means the skill can cause the agent to spend money without an explicit per-call approval step, though the amounts are tiny and the prices are disclosed in the file. All network destinations are the vendor's own documented API plus two informational links (its docs and a ratings page); nothing is hidden, obfuscated, or sent anywhere unexpected. The only data leaving the agent is the company identifier or name being looked up.
| Declared purpose | Verify Brazilian companies by CNPJ using official government data sources, paying per API call via the x402 micro-payment protocol. |
| Observed behavior | Pure instructional markdown. It directs the agent to issue HTTP GETs against api.brazilayer.com (free validation/sample routes and paid lookup routes), to validate check digits before paying, and to translate Portuguese field names when reporting results. No code executes, no files are written, no secrets are read. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | HTTP GET requests to https://api.brazilayer.com/v1/... for all lookups (SKILL.md lines 25-54); documentation and ratings links to api.brazilayer.com and agenteconomy.report (line 76-77). |
| payments | needed | Paid routes charge US$0.001-US$0.05 in USDC on Base via x402; SKILL.md line 37-38 says with agentcash 'payment is automatic', i.e. no explicit confirmation prompt in the instructions. |
| shell | needed | Frontmatter requires either 'agentcash' or 'curl' binary (SKILL.md line 10) to make the HTTP calls; no shell command strings with arguments are embedded. |
| credentials | exceeds purpose | None requested. The skill explicitly states 'no API key, no signup' (SKILL.md line 20) and no environment variables are referenced. |
| severity | finding |
|---|---|
| medium | Automatic micro-payments without a confirmation step The instructions tell the agent to call paid endpoints where payment settles automatically through an x402 wallet. Amounts are small and prices are listed, but the SKILL.md itself contains no requirement to confirm spending with the user (only the separate skill-card.md suggests confirming). An agent holding a funded wallet could make repeated paid calls unattended. SKILL.md:37 Pay with your x402 wallet; with agentcash, call the `fetch` tool on the URL and |
| low | Highest-cost route promoted as a convenience default A single US$0.05 combined call is offered and used as the worked example on line 54. The guidance does advise starting with the US$0.001 route first (line 59), so this is a cost-awareness note rather than a deceptive pattern. SKILL.md:49 | **Everything above in one call** (registry + partners + sanctions + BCB + contracts) | `GET /v1/empresa/enriquecer/<cnpj>` | US$ 0.05 | |
| low | Lookup terms are sent to a third party Company names and CNPJs supplied by the user are transmitted to api.brazilayer.com. This is inherent to the skill's purpose, but it means the third-party operator sees which entities are being screened, which can be sensitive during due diligence. SKILL.md:27 `GET https://api.brazilayer.com/v1/cnpj/busca?q=<name>`. |
| low | API responses can suggest further paid calls The remote service returns upsell suggestions inside its responses. The skill instructs the agent to surface them only when relevant, but this is server-controlled content that could influence an agent's spending decisions. SKILL.md:66 Every response includes `veja_tambem` with the next useful route and its price; mention it only |
| info | Requires an HTTP client or payment-capable client Declares a dependency on curl or the agentcash payment client. No package installation, downloads of executables, or piping of remote content into a shell appear anywhere in the package. SKILL.md:10 anyBins: ["agentcash", "curl"] |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| agenteconomy.report | not in the service index | SKILL.md:77 |
| api.brazilayer.com | B | SKILL.md:5 |
| clawhub.ai | not in the service index | skill-card.md:9 |
| Binaries invoked | curl |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 1 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 77 | 534ac45b55ebdd95… |
_meta.json | 6 | afdac0fb678b1fed… |
skill-card.md | 60 | 5dfe8688c9593efe… |
For agents
JSON: https://agenteconomy.report/k/brazil-kyb.audit.json · badge: https://agenteconomy.report/k/brazil-kyb.audited.svg ·
skill rating: /k/brazil-kyb · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: amostra.