Mayar.id Payment

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:10 AM UTC
• Version: 1.0.0

Overview

This Mayar payment skill is purpose-aligned, but its setup and examples expose payment credentials and customer/payment workflows to avoidable security risks.

Install only if you are comfortable giving the configured MCP server access to your Mayar payment account. Pin or preinstall the MCP bridge instead of running an unpinned `npx -y` command, avoid putting live tokens directly in shared config or process arguments, use sandbox tokens first, and do not copy the webhook or `execSync` examples into production without authentication, idempotency, input validation, and consent controls for customer messaging.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:34

Finding

Unpinned npm Package Is Downloaded and Executed Through npx

Content

View full analysis

Remediation

View remediation

", "https://mcp.mayar.id/sse" ] ``` 2. Prefer an explicit installation controlled by a lockfile instead of downloading packages during every MCP launch. 3. Commit and enforce a package lockfile with integrity hashes. 4. Verify the package publisher, repository, release signatures, and transitive dependencies before adoption. 5. Use a private or allowlisted package registry where practical. 6. Run the MCP process in a restricted account or sandbox with access only to the credentials and resources necessary for Mayar operations. 7. Establish a controlled dependency-update process that performs security review before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/integration-examples.md:401

Finding

Shell Command Injection Through Interpolated Invoice Data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:21

Finding

Mayar API Token Is Placed in Plaintext Configuration and Process Arguments

Content

View full analysis

~/.config/mayar/credentials << EOF MAYAR_API_TOKEN="your-jwt-token-here" EOF chmod 600 ~/.config/mayar/credentials ``` ```json { "mcpServers": { "mayar": { "command": "npx", "args": [ "-y", "mcp-remote", "https://mcp.mayar.id/sse", "--header", "Authorization:YOUR_API_TOKEN_HERE" ] } } } ``` The documentation then instructs the user to replace `YOUR_API_TOKEN_HERE` with the actual JWT token. ### Technical Analysis Creating a user-scoped credentials file is consistent with the declared payment integration, and `chmod 600` appropriately restricts the file to its owner. This filesystem access does not, by itself, exceed the minimum privilege required to store a Mayar credential. The security issue is that the documented MCP configuration does not consume the protected credentials file. Instead, it directs the user to duplicate the real token directly into `config/mcporter.json` and pass it as a command-line argument. Consequently, the token may be exposed through: - Readable or insufficiently protected MCP configuration files - Configuration backups or support bundles - Accidental commits to source control - Process inspection facilities on systems where command arguments are visible - Diagnostic output that records process arguments - Error reporting or configuration-sharing workflows No real credential is embedded in the repository, but following the instructions results in plaintext secret placement. ### Attack Path 1. A user follows the setup instructions and replaces the placeholder with a production JWT. 2. The token is saved in the MCP configuration and passed in the process argument list. 3. Another local process, user, backup ...[truncated 823 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/api-reference.md:407

Finding

Payment Webhook Example Processes Events Without Source Authentication

Content

View full analysis

{ // Respond immediately res.status(200).json({ received: true }); // Process async processPayment(req.body).catch(console.error); }); ``` The only subsequent verification guidance is conditional and does not implement a control: ```markdown ### 3. Validate Webhook Signature (If Mayar provides signature verification - check docs) ``` ### Technical Analysis The example passes an unauthenticated request body to `processPayment`. A publicly accessible webhook endpoint cannot assume that an incoming request originated from Mayar. The documented payload includes payment status and customer information, and other examples use successful payment events to grant course access, send tickets, or confirm fulfillment. The example does not demonstrate: - Cryptographic signature or shared-secret verification - Independent transaction verification through the Mayar API - Timestamp validation - Replay detection - Event identifier deduplication - Validation that the invoice, amount, currency, and customer match a local pending order Responding before processing is a valid availability pattern, but authentication and durable event recording must occur before acknowledging or acting on the event, depending on the provider's retry contract. ### Attack Path 1. An application deploys the documented webhook handler and exposes it publicly. 2. An attacker identifies or guesses the webhook endpoint. 3. The attacker submits a forged body containing an event such as `transaction.paid`. 4. The handler immediately returns success and sends the unverified body to `processPayment`. 5. Downstream business logic treats the event as a legitimate payment. 6. The application grants access, delivers digital goods or ticket ...[truncated 616 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/integration-examples.md (reported line 235)May include surrounding context.

md

// 3. Grant course access
  await grantCourseAccess(paidInvoice.customer.email);
  
  // 4. Send access credentials
  message({
    action: 'send',
    channel: 'whatsapp',

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 10)May include surrounding context.

md

## 🎯 Features

- ✅ Create payment invoices with itemized billing
- ✅ Generate payment links for customers  
- ✅ Track transactions & payment status
- ✅ Support ALL Indonesian payment methods (bank transfer, e-wallet, QRIS)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README instructs users to place a JWT API token into a local credentials file and also shows putting the token directly into mcporter configuration headers, but it never warns against committing, sharing, or logging those secrets. In a payment-processing context, exposed API tokens could allow unauthorized invoice creation, transaction lookup, webhook changes, or other account actions against the Mayar account.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 223)May include surrounding context.

"Webhook not working"

1. Register webhook URL:

bash

curl -X POST https://api.mayar.id/hl/v1/webhook/register \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"urlHook":"https://yoursite.com/webhook"}'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: mayar-payment
description: Mayar.id payment integration for generating invoices, payment links, and tracking transactions via MCP. Use when needing to: (1) Create payment invoices/links for customers, (2) Track payment status and transactions, (3) Generate WhatsApp-friendly payment messages, (4) Handle Indonesian payment methods (bank transfer, e-wallet, QRIS), (5) Manage subscriptions/memberships, or (6) Automate payment workflows for e-commerce, services, or digital products.
---

# Mayar Payment Integration

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs users to place a live Mayar API token in a local credentials file and then inline that token into MCP configuration headers, without any warning about the token's sensitivity or guidance on secret-safe handling. Because this token appears to grant payment-account access, accidental disclosure through config files, shell history, logs, screenshots, or repo commits could let an attacker create invoices, inspect transactions, or otherwise act on the payment account.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 53)May include surrounding context.

cat > ~/.config/mayar/credentials << EOF MAYAR_API_TOKEN="your-jwt-token-here" EOF chmod 600 ~/.config/mayar/credentials

text

### 2. Configure MCP Server

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

cat > ~/.config/mayar/credentials << EOF MAYAR_API_TOKEN="your-jwt-token-here" EOF chmod 600 ~/.config/mayar/credentials

text

### 2. Configure MCP Server

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 223)May include surrounding context.

Production:

text

https://api.mayar.id/hl/v1/

Sandbox (Testing):

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 252)May include surrounding context.

Production:

text

https://api.mayar.id/hl/v1/

Sandbox (Testing):

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.

Production:

text

https://api.mayar.id/hl/v1/

Sandbox (Testing):

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 25)May include surrounding context.

Production:

text

https://api.mayar.id/hl/v1/

Sandbox (Testing):

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 256)May include surrounding context.

Sandbox (Testing):

text

https://api.mayar.club/hl/v1/

Core Endpoints

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.

Sandbox (Testing):

text

https://api.mayar.club/hl/v1/

Core Endpoints

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 30)May include surrounding context.

Sandbox (Testing):

text

https://api.mayar.club/hl/v1/

Core Endpoints

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The webhook guidance shows accepting and asynchronously processing webhook bodies while only noting signature validation as an optional check. In a payment-processing context, this can lead integrators to trust unauthenticated webhook events or mishandle sensitive customer and transaction data, enabling forged payment notifications or data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The examples transmit personally identifiable information such as customer name, email, and phone number to payment services and WhatsApp without documenting consent, lawful basis, or data-minimization expectations. In production integrations, this can create privacy violations, compliance exposure, and unintended disclosure of customer data to third-party systems.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example builds shell commands with template interpolation and executes them via execSync, which is dangerous if any interpolated field can contain attacker-controlled input. In integration code, names, emails, descriptions, phone numbers, and item data often originate from users or external systems, so this pattern can lead to command injection and arbitrary command execution on the host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Multiple example messages and formatting calls are fixed to Indonesian, including Indonesian-language WhatsApp text and explicit locale formatting such as 'id-ID'. Because the file does not state that the skill is intentionally Indonesia-only or provide a user locale option, this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This file is framed as 'Mayar Integration Examples' and mainly demonstrates payment and transaction operations, but several examples also perform unrelated side-effecting actions such as sending WhatsApp messages and granting course or ticket access. With no manifest available to justify broader automation scope, these extra capabilities are not clearly required by a payment integration example alone.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The polling and reminder flows automatically contact users over WhatsApp based on transaction state, but the examples do not warn that this creates autonomous outbound messaging behavior. Without consent, opt-out handling, rate limits, and recipient verification, such automation can lead to spam, privacy complaints, or messages sent to the wrong person.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The inline comment 'Stop polling' claims the code halts the interval, but the code passes 'this' to clearInterval rather than the handle returned by setInterval. That means the documented intent of stopping the polling loop is contradicted by the implementation shown.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The guidance says to 'Always use Jakarta timezone for Indonesian customers,' which enforces a specific locale/timezone behavior in natural language. Without documenting that the skill is region-specific or allowing configuration, this can violate locale-choice expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The documented create_invoice tool requires customer name, email, phone number, and order details, which are privacy-sensitive fields likely transmitted to an external payment service. The markdown explains inputs and usage but omits any warning that the operation shares customer data and creates a live payment artifact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file documents a tool that emails a customer portal access link using a customer's email address, which is a privacy-relevant action affecting user data. The description presents the behavior as a simple capability but does not include any warning or disclosure about sending data externally or ensuring the recipient address is correct.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.