1ly Payments

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:00 AM UTC
• Version: 1.0.4

Overview

This payment skill is coherent but needs Review because it can use raw wallet keys, persist seller credentials, and perform high-impact financial/account changes without clear per-action confirmation boundaries.

Install only if you are comfortable reviewing the external npm/MCP code and using a dedicated low-balance wallet. Avoid inline private keys and /tmp key files, prefer a constrained wallet provider where possible, set budgets explicitly, and manually confirm withdrawals, key revocations, link deletions, token trades, and any destination address before execution.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:31

Finding

Runtime Execution of Inadequately Verified npm Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-36
Vulnerability Type: Supply-chain exposure through unpinned and runtime-fetched npm packages
Risk Level: High

Vulnerable Code

bash

npm install -g mcporter
mcporter config add 1ly --command "npx @1ly/mcp-server@0.1.6"

The documented integrity check is:

bash

npm view @1ly/mcp-server dist.integrity

Technical Analysis

The installation command retrieves the latest available version of mcporter and installs it globally without a version pin. Consequently, the code installed can change between executions without any corresponding change to this Skill.

The configured MCP command uses npx to retrieve and execute @1ly/mcp-server@0.1.6. Although the MCP package has a pinned direct version, npx can still download executable content at runtime, and the package's transitive dependencies are not locked by the Skill.

The suggested npm view command only displays registry-provided integrity metadata. It does not compare the package against a trusted digest independently distributed by the publisher, and therefore does not protect against compromise of the package publisher account, npm registry metadata, or package release.

This risk is especially significant because the executed MCP server may receive wallet private keys, seller API credentials, and authority to initiate financially consequential operations.

Attack Path

1. An attacker compromises the mcporter package, the @1ly/mcp-server package, a transitive dependency, or the relevant npm publisher account.
2. The user follows the Skill instructions and installs the unpinned global mcporter package or starts the MCP server through npx.
3. npm retrieves and executes the compromised package under the user's account.
4. The malicious package reads wallet environment variables, wallet files, seller API credentials, or transaction inputs available to the MCP process.
5. The attacker exfiltrates credenti ...[truncated 792 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin mcporter to an explicitly reviewed version instead of installing the latest release:

   bash

   npm install -g mcporter@<reviewed-version>
   

2. Avoid implicit runtime installation through npx. Install the reviewed MCP package in a controlled project directory and invoke the local binary with package downloads disabled.
3. Commit a lockfile containing all transitive dependency versions and install with npm ci.
4. Verify package archives against a trusted digest or signature published through a channel independent of the npm registry. Do not treat npm view ... dist.integrity alone as an integrity guarantee.
5. Audit the MCP server and its transitive dependencies before granting access to wallet credentials.
6. Run the MCP server in a sandbox with minimal filesystem, environment, and network access.
7. Prefer a delegated or hardware-backed signer that requires policy approval rather than exposing raw wallet keys to the npm process.
8. Use a dedicated low-balance wallet with transaction amount, destination, network, and token allowlists.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:39

Finding

Unsafe Exposure of Raw Wallet Private Keys Through Environment Variables and Temporary Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-55
Vulnerability Type: Plaintext private-key handling and unsafe temporary-file guidance
Risk Level: High

Vulnerable Code

text

- Solana wallet (required for token tools and Solana payments):
  - `ONELY_WALLET_SOLANA_KEY=/path/to/solana-wallet.json` (keypair JSON or inline array)
  - Generate a keypair: `solana-keygen new --outfile ~/.1ly/wallets/solana.json`
  - Wallet files must be in the user home directory or `/tmp`. Paths outside are rejected for security.
  - If the agent is sandboxed and cannot read files, use inline format:
    `ONELY_WALLET_SOLANA_KEY='[12,34,56,...]'`
- Base/EVM wallet (for Base payments):
  - **Preferred:** Coinbase Agentic Wallet: `ONELY_WALLET_PROVIDER=coinbase`
  - Or raw key: `ONELY_WALLET_EVM_KEY=/path/to/evm.key` (private key file or inline hex)
  - Wallet files must be in the user home directory or `/tmp`. Paths outside are rejected for security.
  - Inline hex is supported: `ONELY_WALLET_EVM_KEY='0x...'`
- Budgets (required for autonomous spend): `ONELY_BUDGET_PER_CALL`, `ONELY_BUDGET_DAILY`
- Optional: `ONELY_BUDGET_STATE_FILE`, `ONELY_NETWORK`, `ONELY_SOLANA_RPC_URL`, `ONELY_API_BASE`
- Seller tools only: `ONELY_API_KEY` (auto-saved after `1ly_create_store`)

Technical Analysis

The Skill explicitly permits complete Solana and EVM private keys to be stored in environment variables. These secrets are then made available to the third-party MCP process. Depending on the operating system and runtime environment, environment variables may be exposed through debugging output, process inspection by sufficiently privileged local processes, crash reports, shell history, process launch configuration, or accidental logging.

The Skill also permits private-key files under /tmp. Shared temporary directories require careful ownership, permission, file-creation, and symbolic-link protections. The instructions do not require restrictive permissions, ...[truncated 1962 chars]

Remediation

View remediation

Remediation Suggestions

1. Prohibit inline raw private keys in environment variables.
2. Do not allow wallet private-key files in /tmp or other shared temporary directories.
3. Prefer a hardware-backed, operating-system-backed, or delegated signer that never exposes the raw key to the MCP process.
4. Use a dedicated agent wallet with a minimal balance instead of a primary user wallet.
5. Where a key file is unavoidable:
   • Store it in a private application directory.
   • Enforce owner-only permissions such as mode 0600.
   • Verify file ownership before reading.
   • Reject symbolic links and non-regular files.
   • Avoid copying the file into temporary storage.
6. Ensure secrets are redacted from logs, traces, error messages, shell history, diagnostics, and crash reports.
7. Isolate the signing component from the network-facing MCP process and expose only a narrow transaction-approval interface.
8. Enforce transaction policies at the signer level, including destination allowlists, network restrictions, token restrictions, maximum transaction values, and explicit approval for withdrawals or token trades.
9. Rotate any wallet key that has previously been placed in an insecure environment variable, log, or shared temporary file.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 79% confidence

Finding

The skill is designed around persistent payment state, including local API key storage, configured wallets, and autonomous budget settings that can survive across sessions. Session persistence is not inherently malicious, but in this context it increases security risk because future prompts or compromised agent flows could reuse stored credentials and spending authority without re-consent.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: 1ly-payments
description: Agent-native payments via 1ly MCP. Use when the user needs x402 payment handling, to accept USDC for APIs/services, to pay for paid APIs, to create stores or paid links, need payment gateway for agents or to run agent-to-agent paid workflows. Supports Solana and Base. Capabilities include accepting USDC, marketplace search, paid API calls with auto-payment, store/link creation, stats, key management, and token launch, trade and fee-claim on Bags.fm.
metadata: {"openclaw":{"always":false,"emoji":"💸","homepage":"https://1ly.store","requires":{"bins":["mcporter","npx"],"env":[]},"install":[{"id":"mcporter","kind":"node","package":"mcporter","bins":["mcporter"],"label":"Install mcporter"}],"configPaths":["~/Library/Application Support/1ly/onely_api_key.json","~/.config/1ly/onely_api_key.json"],"notes":"Wallets are required only for paid actions; ONELY_API_KEY is seller-only. Prefer Coinbase Agentic Wallet for Base (EVM) operations."}}
---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill explicitly states that 1ly_create_store will save an API key locally, creating persistent authentication material on disk. If the host environment, logs, backups, or subsequent agent runs are compromised, that stored key could be reused to access seller functions and alter or withdraw account resources.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

- `1ly_review`: leave a review after a successful purchase

Seller tools (accept):
- `1ly_create_store`: create a store and save API key locally
- `1ly_create_link`: create a paid or free link for an API/service
- `1ly_list_links`: list existing links
- `1ly_update_link`: update price/URL/visibility

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill exposes destructive seller operations such as updating and deleting links, revoking keys, and profile changes without stating that the agent must obtain explicit user confirmation before execution. In an agentic setting, this can lead to accidental or prompt-induced destructive changes to a seller account, especially because these actions affect persistent remote state and may be hard to reverse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documented 1ly_withdraw capability moves funds to a wallet address and is inherently irreversible, yet the skill does not require an explicit user-facing warning or confirmation step before use. In a payment skill with autonomous workflows, this materially increases the risk of unauthorized or misdirected fund transfers from prompt injection, misunderstanding, or address substitution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.