peer-cash

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:00 AM UTC
• Version: 1.0.0

Overview

The skill is coherent and includes strong wallet-approval safeguards, but its setup runs an unpinned npm MCP package for a financial workflow, so users should review the supply-chain risk before installing.

Install only if you trust the `peer-cash-mcp` npm package and its publisher, and prefer pinning a reviewed exact version or using a verified local install. Keep the wallet-approval safeguards: independently inspect destination, value, calldata, and order details before signing any transaction.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43–45
Vulnerability Type: Insecure third-party dependency execution
Risk Level: Medium

bash

openclaw mcp add peer-cash --command npx --arg -y --arg peer-cash-mcp
openclaw mcp doctor peer-cash --probe

Technical Analysis

The setup instructions register and probe peer-cash-mcp through npx -y without specifying an exact package version or integrity constraint. The -y option suppresses the installation confirmation. As a result, npm may download and execute whichever package release its registry resolves at runtime.

This creates a supply-chain trust gap: the executed artifact can change after the Skill has been reviewed. The referenced GitHub homepage does not cryptographically bind the npm artifact to a reviewed source revision. Compromise of the package, its maintainer account, or the registry delivery path could therefore introduce arbitrary code into the MCP process.

Attack Path

1. An attacker compromises the peer-cash-mcp npm package, its publisher account, or a release mechanism used to distribute it.
2. The attacker publishes a malicious version that satisfies the unpinned package request.
3. An operator follows the setup instructions, or the registered MCP command is launched later.
4. npx -y peer-cash-mcp downloads and executes the attacker-controlled release without an interactive installation prompt.
5. The malicious package runs with the permissions and environment of the OpenClaw gateway user.
6. It can inspect resources exposed to that process, falsify MCP responses, or substitute malicious transaction preparation data.

Impact Assessment

Successful exploitation provides arbitrary code execution with the privileges of the account running the OpenClaw gateway or MCP process. The accessible scope may include process-visible environment variables, local files readable by that account, network access, and MCP communications.

Because this Skill support ...[truncated 345 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin peer-cash-mcp to a reviewed, exact version rather than relying on the registry's latest resolution.
2. Install the dependency during a controlled deployment phase using a lockfile and verified integrity hash.
3. Configure OpenClaw to execute a verified local binary instead of dynamically invoking npx -y.
4. Avoid suppressing installation confirmation when an artifact has not already been verified.
5. Verify the npm package provenance and bind the deployed artifact to a reviewed source commit or signed release.
6. Run the MCP server under a dedicated least-privilege account or sandbox with restricted filesystem, environment-variable, and network access.
7. Preserve the existing requirement to display and approve exact transaction details, and independently validate destinations, values, and calldata before wallet submission.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill instructs operators to run openclaw mcp add peer-cash --command npx --arg -y --arg peer-cash-mcp, which fetches and executes the peer-cash-mcp package without pinning a specific version. That creates a real supply-chain risk: a compromised upstream package, malicious new release, dependency hijack, or typo/registry attack could lead to arbitrary code execution on the host where the MCP server is installed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.