PaySpawn — On-Chain Spending Limits for AI Agents

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:12 PM UTC
• Version: 1.0.0

Overview

This is a coherent payment-integration skill, but users should treat it as real spending authority and use tight limits.

Install only if you intend to give agents real, bounded USDC spending ability. Use a dedicated low-value credential, set strict daily and per-transaction caps, whitelist recipients or endpoints where possible, require approval for paid POST requests, and pin/audit the SDK before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24
• Finding: Unpinned Third-Party Financial SDK Introduces Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 24-26 **Vulnerability Type**: Unpinned and unverifiable third-party dependency **Risk Level**: Medium ```bash npm install @payspawn/sdk ``` ### Technical Analysis The Skill instructs users to install `@payspawn/sdk` without specifying a reviewed version or integrity hash. The audited project does not include a package lockfile, vendored implementation, source-code reference, or other mechanism for verifying the exact package contents. Consequently, the installed code may change after this Skill has been reviewed. npm packages can also execute lifecycle scripts during installation. At runtime, this SDK is given access to `PAYSPAWN_CREDENTIAL` and is used to initiate USDC payments. A compromised package release, package-maintainer account, or dependency in the package's transitive dependency tree could therefore execute code under the installing user's account, access the spending credential, or manipulate payment operations. The audit does not establish that the current package is malicious. The finding concerns the Skill's reliance on an unpinned, externally mutable dependency for security-sensitive financial operations without reproducible dependency controls. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or a transitive dependency and publishes a malicious release. 2. A user follows the Skill and runs `npm install @payspawn/sdk`. 3. Because no version is pinned, npm resolves a currently available compatible release rather than a specific audited artifact. 4. Malicious lifecycle code may execute during installation, or malicious SDK logic may execute when the package is imported and used. 5. At runtime, the compromised SDK can attempt to read `PAYSPAWN_CREDENTIAL`, redirect or modify payment requests, transmit sensitive information, or consume the spending authorization available to the credential. ### Impact Assessment ...[truncated 713 chars]
• Remediation: ## Remediation Suggestions 1. Pin `@payspawn/sdk` to an exact, independently reviewed version rather than installing the latest release implicitly. 2. Provide and commit a lockfile that records the complete transitive dependency graph and integrity hashes. 3. Publish the SDK's authoritative source repository, release-signing process, package provenance, and corresponding smart-contract addresses in the Skill documentation. 4. Verify package provenance and npm integrity metadata before installation; consider using signed releases and reproducible builds. 5. Disable npm lifecycle scripts during installation where compatible, such as through `npm install --ignore-scripts`, and explicitly document any scripts that are genuinely required. 6. Audit the SDK, its transitive dependencies, and the deployed smart contracts before using credentials backed by funded accounts. 7. Apply restrictive daily, per-transaction, velocity, and recipient limits, and use a dedicated low-value credential so dependency compromise has a bounded financial impact. 8. Implement dependency monitoring and require security review before upgrading the pinned SDK version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

External Transmission

Medium

• Category: Data Exfiltration

Content

const ps = new PaySpawn(process.env.PAYSPAWN_CREDENTIAL);

// Pay an x402 API automatically
const res = await ps.fetch("https://api.example.com/data");
const data = await res.json();

// Direct USDC payment

• Confidence: 89% confidence
• Finding: The example performs an external fetch to a remote API using a payment-enabled client, which can send agent-controlled data off-system and may trigger real USDC spending automatically. Although this is core functionality, the documentation presents it as a simple fetch without clearly surfacing the security and financial implications for agents executing the skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documents `ps.fetch()` as automatically handling paid HTTP 402 flows, but it does not explicitly warn that invoking it sends request data to third-party services and can trigger real on-chain USDC spending. In an agent-skill context, this omission is dangerous because downstream users may treat the example as a harmless fetch call rather than a state-changing, cost-incurring external action.

External Transmission

Medium

• Category: Data Exfiltration

Content

```typescript
// Works with any x402-compatible API
const result = await ps.fetch("https://paid-api.example.com/endpoint", {
  method: "POST",
  body: JSON.stringify({ task: "do something" })
});

• Confidence: 92% confidence
• Finding: This example shows a POST request to an external paid API with a JSON body, which implies outbound transmission of potentially sensitive task data to a third party while also allowing automatic payment. In the context of an autonomous agent payment skill, combining data exfiltration and automatic spending increases the risk of prompt-injection-driven misuse, accidental disclosure, and unintended charges.