Security audit

Send USD Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill claims to send real USD, but its code returns successful payment confirmations without authentication or any actual payment backend.

Do not install this as a real payment skill. It may be acceptable only as a clearly isolated mock after relabeling, but production use would need authenticated sender identity, explicit user confirmation, real provider or ledger integration, authoritative settlement status, durable audit records, and stricter amount validation.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: code.js:16
Finding: Missing Authentication and Sender Authorization
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: code.js:54
Finding: Fabricated Successful Transfers Without Payment Execution or Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: code.js:36
Finding: Non-Finite and Unbounded Monetary Amounts Are Accepted
Content: View full analysis
Remediation: View remediation
MAX_TRANSFER_CENTS ) { return { success: false, transaction_id: null, message: "Invalid amount", error_code: "INVALID_AMOUNT", }; } ``` ]]>

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This skill performs irreversible financial actions but does not warn the user or require an explicit confirmation step before initiating a transfer. In agent-driven environments, ambiguous or automatic execution of payment actions can lead to unintended fund transfers from prompt injection, user misunderstanding, or misrouted agent requests.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is described as sending USD between agents, but the implementation only fabricates a success response and transaction ID without invoking any payment rail or ledger update. This can mislead calling systems into believing funds were transferred, causing accounting inconsistencies, false settlement, business logic bypass, or downstream release of goods/services based on a non-existent payment.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.