PaySpawn — On-Chain Spending Limits for AI Agents

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:08 PM UTC
• Version: 1.0.3

Overview

The skill is transparent about enabling limited agent payments, but it asks users to install an unpinned financial SDK that will handle a spending credential.

Review this before installing because the payment behavior is intentional but financially sensitive. Use the lowest daily and per-transaction limits, set recipient allowlists and short expirations, keep revocation available, and prefer an exact reviewed SDK version or lockfile instead of the unversioned npm install command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Financial SDK Dependency Allows Supply-Chain Substitution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:12-17 and SKILL.md:31-35
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml

install:
  - package: "@payspawn/sdk"
    registry: "npm"
    version: ">=5.3.0"
    source: "https://www.npmjs.com/package/@payspawn/sdk"
    audit: "https://github.com/adambrainai/payspawn"

bash

npm install @payspawn/sdk

Technical Analysis

The skill permits any version of @payspawn/sdk equal to or newer than 5.3.0, while the documented installation command installs the registry's current default version. Neither an exact version nor an artifact integrity hash is specified.

This SDK operates in a financially sensitive context: it receives PAYSPAWN_CREDENTIAL, constructs USDC payments, and communicates with external services and blockchain contracts. Consequently, a malicious or compromised future package release would execute in the agent's process with access to the credential and payment workflow.

The repository and audit links do not ensure that the installed npm artifact corresponds to reviewed source code. The audited project contains no lockfile, vendored dependency, checksum, or reproducible-build verification that would constrain the installed implementation.

Attack Path

1. An attacker compromises the npm publisher account, package build pipeline, or another component of the package publication process.
2. The attacker publishes a malicious release that satisfies the >=5.3.0 version constraint or changes the package version selected by the unversioned installation command.
3. A user follows the skill instructions and runs npm install @payspawn/sdk.
4. npm resolves and installs the attacker-controlled release.
5. The agent imports the package and passes PAYSPAWN_CREDENTIAL to its constructor.
6. The malicious implementation can read or transmit that credential, manipulate recipient ...[truncated 1302 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the open-ended version range with an exact, reviewed release, such as 5.3.0, and show that exact version in the installation command:

   bash

   npm install --save-exact @payspawn/sdk@5.3.0
   

2. Commit a package lockfile containing npm integrity metadata and require deterministic installation with npm ci.
3. Verify npm package provenance, publisher identity, signatures or attestations, and correspondence between the published artifact and reviewed repository source.
4. Perform dependency and source review before every intentional upgrade. Use an automated update process that requires security approval rather than accepting arbitrary future releases.
5. Run the SDK in a least-privileged process or isolated container with access only to the required credential and network destinations.
6. Ensure the agent process cannot read unrelated wallet keys, deployment credentials, cloud credentials, or sensitive host files.
7. Configure the lowest practical daily and per-transaction limits, enforce recipient allowlists, use short credential expirations, and rotate credentials regularly.
8. Monitor payment activity and maintain an independently verified emergency revocation procedure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

const ps = new PaySpawn(process.env.PAYSPAWN_CREDENTIAL);

// Auto-pay x402 APIs within your set limits
const res = await ps.fetch("https://api.example.com/endpoint");

// Send a payment
await ps.pay("0xRecipientAddress", 1.00);

Static analysis

No suspicious patterns detected.