Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-03
This is a documentation-only skill: a single markdown instruction file that tells an AI agent how to act as a security reviewer, plus a metadata file and a publisher card. It contains no scripts, no installers, and no code that runs on its own. The content is a standard OWASP Top 10 checklist with TypeScript code samples (parameterized queries, bcrypt hashing, JWT handling, security headers, Zod input validation) and a suggested report format. The only external references are the placeholder domain api.example.com inside a Content-Security-Policy example and the publisher's ClawHub profile link. Mentions of API_KEY and JWT_SECRET are illustrative 'read secrets from environment variables instead of hardcoding them' examples, not attempts to collect them. It does suggest the agent run local dependency-audit commands (npm audit, npx better-npm-audit, npx npm-check-updates -u), the last of which modifies package.json, so a user should approve commands before they execute.
| Declared purpose | A security specialist skill for reviewing code for vulnerabilities, auditing against OWASP Top 10, and advising on authentication, input validation, secrets handling, and security headers. |
| Observed behavior | Purely prose and code-example guidance for the agent. It instructs the agent to audit code, list findings in a structured markdown report, and flag sensitive files (.env*, auth config, middleware, package.json) for careful review. It suggests running local npm/npx audit commands. No network calls, no file writes, no credential access, no persistence, and no obfuscated content are present anywhere in the package. |
| Verdict, rules only | CAUTION · runs subprocesses or eval/exec; reads credential-like environment variables: API_KEY, JWT_SECRET |
| Verdict, AI | SAFE |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| filesystem_read | needed | The skill's whole function is reading project source files to audit them; it also names sensitive paths like `.env*` and `auth.ts` as files to review carefully (SKILL.md lines 393-394). No code in the package reads or transmits those files. |
| shell | needed | Suggests dependency-audit shell commands: `npm audit`, `npm audit fix`, `npx better-npm-audit audit`, `npx npm-check-updates -u` (SKILL.md lines 348-355). These execute local package tooling; `npm-check-updates -u` rewrites package.json version ranges. |
| install_packages | exceeds purpose | `npx` fetches and runs packages (better-npm-audit, npm-check-updates) from the npm registry at invocation time (SKILL.md lines 352, 355). This is common developer tooling but does mean remote code is downloaded and executed. |
| network | exceeds purpose | No network requests are made by the skill. `api.example.com` (SKILL.md line 188) is a placeholder inside a CSP example string, and clawhub.ai (skill-card.md line 7) is the publisher profile link. |
| severity | finding |
|---|---|
| low | Suggested command downloads a remote package and edits package.json `npx` fetches npm-check-updates from the registry and runs it; the `-u` flag rewrites dependency versions in package.json. If an agent runs this without confirmation it changes project files and pulls remote code. Standard developer tooling, but worth approving explicitly. SKILL.md:355 npx npm-check-updates -u |
| info | Third-party audit tool executed via npx Runs a remotely fetched package for vulnerability scanning. Read-only in effect, but it is remote code execution triggered by the skill's guidance rather than a locally pinned dependency. SKILL.md:352 npx better-npm-audit audit |
| info | Skill directs attention to secret-bearing files The skill lists .env files and auth configuration among files to inspect. It frames these as 'review carefully before modification' and contains no code that reads, copies, or transmits them, so this is consistent with a security-audit role rather than exfiltration. SKILL.md:393 - `.env*` — environment secrets |
| info | Sensitive environment variable names appear only in examples API_KEY (line 331) and JWT_SECRET (line 265) appear inside instructional code snippets demonstrating that secrets should come from the environment rather than be hardcoded. No collection or transmission of these values occurs. SKILL.md:331 const API_KEY = process.env.API_KEY |
| info | Only external domain is a documentation placeholder api.example.com appears inside a sample Content-Security-Policy header string. It is not a request destination; there is no hidden endpoint in the package. SKILL.md:188 "connect-src 'self' https://api.example.com", |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| api.example.com | not in the service index | SKILL.md:188 |
| clawhub.ai | not in the service index | skill-card.md:7 |
| Binaries invoked | bash, npm, npx |
| Environment variables read | API_KEY, JWT_SECRET |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 4 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 399 | 808e854691696a83… |
_meta.json | 6 | 231f237bf75cc662… |
skill-card.md | 38 | feeb67b1cbdf6ba2… |
For agents
JSON: https://agenteconomy.report/k/security-auditor.audit.json · badge: https://agenteconomy.report/k/security-auditor.audited.svg ·
skill rating: /k/security-auditor · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: amostra.