Settld MCP Payments

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:51 PM UTC
• Version: 0.1.0

Overview

The skill is clearly for Settld paid MCP tool use, but its setup runs an unpinned npm package with Settld credentials, which deserves review before installation.

Install only if you trust the Settld MCP npm package and can run it with a narrowly scoped, revocable API key. Prefer pinning an exact reviewed package version, using a controlled install with lockfile or integrity checks, and enforcing tenant policy or spend limits before enabling paid tools.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: mcp-server.example.json:3

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: mcp-server.example.json:3-4; duplicated in SKILL.md:30-31
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

mcp-server.example.json:3-4:

json

"command": "npx",
"args": ["-y", "settld-mcp"],

SKILL.md:30-31:

text

- command: `npx`
- args: `["-y","settld-mcp"]`

Technical Analysis

The MCP server configuration invokes npx -y settld-mcp without specifying an exact package version or verifying package integrity. If the package is not already available locally, npx can retrieve it from the configured npm registry and execute it immediately. The -y option suppresses the installation confirmation prompt.

This design causes the code executed by the Skill to depend on whichever package version the registry resolves at runtime rather than a version reviewed alongside this project. A compromised publisher account, malicious package release, registry compromise, or unexpected upstream update could therefore introduce arbitrary executable code after the Skill itself has been audited.

The spawned package receives the configured environment, including SETTLD_API_KEY, SETTLD_TENANT_ID, and service endpoint values. The repository provides no evidence that settld-mcp is currently malicious; the risk arises from automatic execution of an unpinned and externally supplied dependency.

Attack Path

1. An attacker compromises the settld-mcp publishing account or otherwise causes a malicious version to be resolved by the npm registry.
2. A user registers or starts the documented MCP server configuration.
3. npx -y settld-mcp downloads the currently resolved package without interactive confirmation or an exact version constraint.
4. The downloaded package executes with the privileges of the process running the agent.
5. The malicious package reads environment variables supplied to the MCP ...[truncated 992 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the floating package reference with an exact, reviewed version, such as settld-mcp@X.Y.Z; do not use version ranges.
2. Install the dependency during a controlled build or deployment phase rather than downloading it when the MCP server starts.
3. Commit and enforce an npm lockfile containing integrity hashes, and use npm ci against an approved registry.
4. Verify package provenance, signatures, checksums, publisher identity, and release contents before upgrades.
5. Remove -y from ad hoc runtime installation workflows so unexpected package retrieval cannot proceed silently.
6. Run the MCP server in a sandbox or container with a non-privileged account, restricted filesystem access, and narrowly allowlisted network destinations.
7. Supply a narrowly scoped, short-lived, and revocable Settld API key. Avoid granting settlement or payment permissions not required by the intended tools.
8. Establish dependency monitoring and an explicit review process for every package-version update.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This manifest defines the skill name and launch command but provides no description of when the skill should be invoked or what user phrases should activate it. For manifest files, the absence of any explicit trigger scope or constraints can make invocation behavior ambiguous in downstream systems.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: mcp-server.example.json:6