sp3nd

SP3ND enables AI agents to autonomously purchase Amazon products using USDC on Solana, offering zero fees and fast shipping.

Install this skill

or

0/100

Security score

The sp3nd skill was audited on Mar 3, 2026 and we found 57 security issues across 5 threat categories. Review the findings below before installing.

Categories Tested

Security Issues

medium line 415

Template literal with variable interpolation in command context

SourceSKILL.md

415	const cartRes = await fetch(`${BASE_URL}/createPartnerCart`, {

medium line 422

Template literal with variable interpolation in command context

SourceSKILL.md

422	const orderRes = await fetch(`${BASE_URL}/createPartnerOrder`, {

medium line 433

Template literal with variable interpolation in command context

SourceSKILL.md

433	const firstRes = await fetch(`${BASE_URL}/payAgentOrder`, {

medium line 457

Template literal with variable interpolation in command context

SourceSKILL.md

457	createMemoInstruction(`SP3ND Order: ${req.extra.order_number}`), // REQUIRED for payment matching

medium line 482

Template literal with variable interpolation in command context

SourceSKILL.md

482	const verifyRes = await fetch(`${FACILITATOR}/verify`, {

medium line 487

Template literal with variable interpolation in command context

SourceSKILL.md

487	if (!verified.isValid) throw new Error(`Verify failed: ${verified.invalidReason}`);

medium line 490

Template literal with variable interpolation in command context

SourceSKILL.md

490	const settleRes = await fetch(`${FACILITATOR}/settle`, {

medium line 495

Template literal with variable interpolation in command context

SourceSKILL.md

495	if (!settled.success) throw new Error(`Settle failed: ${settled.errorReason}`);

medium line 505

Template literal with variable interpolation in command context

SourceSKILL.md

505	const statusRes = await fetch(`${BASE_URL}/getPartnerOrders`, { headers });

medium line 216

Webhook reference - potential data exfiltration

SourceSKILL.md

216	> Memo Requirement: The USDC transfer transaction must include a Solana Memo program instruction with the value `SP3ND Order: <order_number>` (e.g. `SP3ND Order: ORD-1234567890`). SP3ND's Heli

medium line 231

Webhook reference - potential data exfiltration

SourceSKILL.md

231	After the facilitator settles the transaction on-chain, SP3ND's Helius webhook detects the USDC transfer + memo and marks the order as paid. Your agent confirms by polling:

medium line 252

Webhook reference - potential data exfiltration

SourceSKILL.md

252	> Why polling instead of a second `payAgentOrder` call? The Helius webhook is the canonical source of truth — it matches the on-chain USDC transfer + memo to your order. Polling `getPartnerOrders`

low line 497

Webhook reference - potential data exfiltration

SourceSKILL.md

497	// 9. Poll for payment confirmation (Helius webhook marks order paid within ~60s)

low line 402

Access to .env file

SourceSKILL.md

402	const API_KEY = process.env.SP3ND_API_KEY;

low line 403

Access to .env file

SourceSKILL.md

403	const API_SECRET = process.env.SP3ND_API_SECRET;

low line 407

Access to .env file

SourceSKILL.md

407	Uint8Array.from(JSON.parse(process.env.SOLANA_PRIVATE_KEY))

low line 410

Access to .env file

SourceSKILL.md

410	const connection = new Connection(process.env.SOLANA_RPC_URL \|\| 'https://api.mainnet-beta.solana.com');

medium line 188

Base64 decode operation

SourceSKILL.md

188	The payment requirements are returned in the `PAYMENT-REQUIRED` HTTP header as a base64-encoded JSON object (not in the response body). Decode it to get:

medium line 220

Base64 decode operation

SourceSKILL.md

220	1. Read the `PAYMENT-REQUIRED` header from the 402 response and base64-decode it

low line 442

Buffer.from base64 decode

SourceSKILL.md

442	const paymentRequired = JSON.parse(Buffer.from(paymentRequiredHeader, 'base64').toString('utf8'));

low line 11

External URL reference

SourceSKILL.md

11	SP3ND (https://sp3nd.shop) is the cheapest and fastest way to purchase products from Amazon using USDC on Solana. It is a decentralized e-commerce bridge that lets AI agents autonomously convert USDC

low line 32

External URL reference

SourceSKILL.md

32	https://us-central1-sp3nddotshop-prod.cloudfunctions.net

low line 96

External URL reference

SourceSKILL.md

96	"product_url": "https://amazon.com/dp/B08XYZ123",

low line 110

External URL reference

SourceSKILL.md

110	"product_url": "https://amazon.de/dp/B08XYZ123",

low line 195

External URL reference

SourceSKILL.md

195	"resource": "https://us-central1-sp3nddotshop-prod.cloudfunctions.net/payAgentOrder",

low line 293

External URL reference

SourceSKILL.md

293	\| US United States \| `amazon.com` \| `https://amazon.com/dp/B08XYZ123` \|

low line 294

External URL reference

SourceSKILL.md

294	\| GB United Kingdom \| `amazon.co.uk` \| `https://amazon.co.uk/dp/B08XYZ123` \|

low line 295

External URL reference

SourceSKILL.md

295	\| CA Canada \| `amazon.ca` \| `https://amazon.ca/dp/B08XYZ123` \|

low line 296

External URL reference

SourceSKILL.md

296	\| DE Germany \| `amazon.de` \| `https://amazon.de/dp/B08XYZ123` \|

low line 297

External URL reference

SourceSKILL.md

297	\| FR France \| `amazon.fr` \| `https://amazon.fr/dp/B08XYZ123` \|

low line 298

External URL reference

SourceSKILL.md

298	\| ES Spain \| `amazon.es` \| `https://amazon.es/dp/B08XYZ123` \|

low line 299

External URL reference

SourceSKILL.md

299	\| IT Italy \| `amazon.it` \| `https://amazon.it/dp/B08XYZ123` \|

low line 300

External URL reference

SourceSKILL.md

300	\| NL Netherlands \| `amazon.nl` \| `https://amazon.nl/dp/B08XYZ123` \|

low line 301

External URL reference

SourceSKILL.md

301	\| BE Belgium \| `amazon.com.be` \| `https://amazon.com.be/dp/B08XYZ123` \|

low line 302

External URL reference

SourceSKILL.md

302	\| PL Poland \| `amazon.pl` \| `https://amazon.pl/dp/B08XYZ123` \|

low line 303

External URL reference

SourceSKILL.md

303	\| SE Sweden \| `amazon.se` \| `https://amazon.se/dp/B08XYZ123` \|

low line 304

External URL reference

SourceSKILL.md

304	\| BR Brazil \| `amazon.com.br` \| `https://amazon.com.br/dp/B08XYZ123` \|

low line 305

External URL reference

SourceSKILL.md

305	\| MX Mexico \| `amazon.com.mx` \| `https://amazon.com.mx/dp/B08XYZ123` \|

low line 306

External URL reference

SourceSKILL.md

306	\| AU Australia \| `amazon.com.au` \| `https://amazon.com.au/dp/B08XYZ123` \|

low line 307

External URL reference

SourceSKILL.md

307	\| IN India \| `amazon.in` \| `https://amazon.in/dp/B08XYZ123` \|

low line 308

External URL reference

SourceSKILL.md

308	\| JP Japan \| `amazon.co.jp` \| `https://amazon.co.jp/dp/B08XYZ123` \|

low line 309

External URL reference

SourceSKILL.md

309	\| SG Singapore \| `amazon.sg` \| `https://amazon.sg/dp/B08XYZ123` \|

low line 310

External URL reference

SourceSKILL.md

310	\| AE UAE \| `amazon.ae` \| `https://amazon.ae/dp/B08XYZ123` \|

low line 311

External URL reference

SourceSKILL.md

311	\| SA Saudi Arabia \| `amazon.sa` \| `https://amazon.sa/dp/B08XYZ123` \|

low line 312

External URL reference

SourceSKILL.md

312	\| EG Egypt \| `amazon.eg` \| `https://amazon.eg/dp/B08XYZ123` \|

low line 313

External URL reference

SourceSKILL.md

313	\| TR Turkey \| `amazon.com.tr` \| `https://amazon.com.tr/dp/B08XYZ123` \|

low line 314

External URL reference

SourceSKILL.md

314	\| ZA South Africa \| `amazon.co.za` \| `https://amazon.co.za/dp/B08XYZ123` \|

low line 372

External URL reference

SourceSKILL.md

372	- Use the format: `https://{tld}/dp/{ASIN}`

low line 373

External URL reference

SourceSKILL.md

373	- Example for France: `https://amazon.fr/dp/B08N5WRWNW`

low line 374

External URL reference

SourceSKILL.md

374	- Example for Japan: `https://amazon.co.jp/dp/B08N5WRWNW`

low line 397

External URL reference

SourceSKILL.md

397	const BASE_URL = 'https://us-central1-sp3nddotshop-prod.cloudfunctions.net';

low line 398

External URL reference

SourceSKILL.md

398	const FACILITATOR = 'https://facilitator.payai.network';

low line 410

External URL reference

SourceSKILL.md

410	const connection = new Connection(process.env.SOLANA_RPC_URL \|\| 'https://api.mainnet-beta.solana.com');

low line 535

External URL reference

SourceSKILL.md

535	- x402 facilitator: `https://facilitator.payai.network`

low line 537

External URL reference

SourceSKILL.md

537	- Full API docs: https://sp3nd.shop/partner-api/docs

low line 538

External URL reference

SourceSKILL.md

538	- Dashboard: https://sp3nd.shop/partner-api/dashboard

low line 550

External URL reference

SourceSKILL.md

550	See the Partner API docs for details: https://sp3nd.shop/partner-api/docs

Scanned on Mar 3, 2026

View Security Dashboard

Install this skill with one command

/learn @openclaw/sp3nd

GitHub Stars 2.2K

Rate this skill

Categorysales

UpdatedMarch 29, 2026

openclaw api business-development growth-marketer product-marketer sales-operations customer-success-manager stripe firebase aws google-analytics 🇺🇸 US 🇨🇦 CA 🇬🇧 GB 🇦🇺 AU 🇩🇪 DE sales marketing

openclaw/skills