ClawHub
Back to skill

Security audit

Setup Reliable Services

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent payment-tool setup guidance, but it uses risky install paths and persists an unpinned payment MCP server.

Review before installing. Prefer the Homebrew path or a pinned, verified release; avoid curl | sh unless you have independently checked the installer. Pin @coinbase/payments-mcp to a reviewed version, confirm any ~/.codex/mcp.json change before saving it, and require explicit user approval and spending limits before paid requests.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:38
Finding

Remote Installer Is Downloaded and Executed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38–42
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet:

markdown
Alternative method (`curl` installer) only with explicit user approval:

```bash
curl -fsSL https://openspend.ai/install | sh
text

### Technical Analysis

The alternative installation method pipes an HTTPS response directly into `sh`. The executed payload is not stored for inspection, pinned to a known version, or validated with a cryptographic checksum or publisher signature. Consequently, the effective code can change after the Skill itself has been reviewed.

Requiring explicit user approval appropriately prevents silent installation, but approval does not establish the integrity or safety of the downloaded program. If the hosting origin, installation endpoint, DNS resolution, TLS trust chain, or publishing process is compromised, attacker-controlled shell commands would execute with the privileges of the user running the agent. This installation channel therefore exceeds the minimum safe mechanism needed to install the declared CLI; a pinned and verified artifact would provide the same functionality with less risk.

### Attack Path

1. An attacker compromises the installer endpoint, its publishing process, or another component of the delivery chain.
2. The user invokes the Skill because OpenSpend is absent or requests installation.
3. The Skill presents the alternative installation command and obtains user approval.
4. `curl` retrieves the attacker-controlled response from the mutable URL.
5. The pipeline passes the response directly to `sh` without inspection or integrity verification.
6. The malicious response executes arbitrary shell commands under the agent user's account.

### Impact Assessment

Successful exploitation provides arbitrary code execution with the privileges of the invoking user. Depending on that accou
...[truncated 397 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | sh pipeline.
  • Prefer the documented package-manager installation route where the package source and release process have been independently validated.
  • If a standalone installer is necessary, pin an exact release and download it to a local file.
  • Verify a publisher signature or a checksum obtained through a trusted, independent channel before execution.
  • Present the resolved version, source, verification result, and commands to the user before obtaining execution approval.
  • Execute the installer with ordinary user privileges and avoid sudo unless a specific operation demonstrably requires elevation.
  • Consider sandboxing the installer and documenting the files, network endpoints, and configuration paths it is expected to access.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:66
Finding

Unpinned MCP Package Is Automatically Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 66–75
Vulnerability Type: Insecure third-party dependency execution
Risk Level: Medium

Complete Code Snippet:

markdown
2. Add MCP server config in your MCP client configuration (for example `~/.codex/mcp.json`).

```json
{
  "mcpServers": {
    "payments": {
      "command": "npx",
      "args": ["-y", "@coinbase/payments-mcp"]
    }
  }
}
text

### Technical Analysis

The MCP configuration invokes `npx -y @coinbase/payments-mcp` without an exact package version or integrity value. `npx` may retrieve the package and execute its lifecycle or runtime code automatically, while `-y` suppresses the normal confirmation prompt. The package resolved by the registry can therefore differ from the version originally assessed.

This is a supply-chain weakness rather than evidence that the named package is currently malicious. A compromised registry account, publishing pipeline, package version, or transitive dependency could introduce attacker-controlled code. Because the command is part of persistent MCP client configuration, package execution may occur when the client starts or reloads the server. Access to `~/.codex/mcp.json` is relevant to the declared setup task and does not itself prove credential access, but adding an unpinned executable dependency to that configuration creates an avoidable trust boundary.

### Attack Path

1. An attacker compromises the package publishing account, registry distribution path, or a dependency used by `@coinbase/payments-mcp`.
2. A malicious package version becomes the version resolved by the unpinned package reference.
3. The user adds the documented MCP server configuration.
4. The MCP client starts or reloads the `payments` server.
5. `npx -y` downloads the currently resolved package without interactive confirmation.
6. Attacker-controlled package code executes with the MCP client user's privileges.
...[truncated 551 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin @coinbase/payments-mcp to an exact, reviewed version rather than relying on the registry's current resolution.
  • Install the dependency explicitly after user approval and use a lockfile with verified integrity metadata.
  • Configure the MCP client to invoke the verified local executable instead of downloading through npx whenever the client starts.
  • Remove -y from first-time installation so unexpected downloads are not silently approved.
  • Review package provenance, publisher identity, release signatures, lifecycle scripts, and relevant transitive dependencies.
  • Run the MCP server with least privilege and restrict its filesystem, environment-variable, credential, and network access to what payment functionality requires.
  • Establish a controlled update process that revalidates new versions before deployment.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill includes a curl-to-shell installer, which fetches remote content and executes it immediately with no opportunity for inspection or integrity verification. Even with explicit user approval, this pattern is dangerous because a compromised server, MITM in weaker environments, or malicious installer update would result in arbitrary code execution on the host.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

Alternative method (curl installer) only with explicit user approval:

bash
curl -fsSL https://openspend.ai/install | sh
  1. Update existing install when openspend is already available.

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The pipe into sh is the command-chaining mechanism that converts a network fetch directly into shell execution, eliminating inspection and making exploitation immediate. In this setup skill, the context increases risk because users are encouraged to run it during environment bootstrap, when commands may be executed with broad local privileges and trust.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

Alternative method (curl installer) only with explicit user approval:

bash
curl -fsSL https://openspend.ai/install | sh
  1. Update existing install when openspend is already available.

MCP Config Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

The skill directs modification of the MCP client configuration file under ~/.codex/mcp.json, which is a sensitive trust boundary because changes there register executable tooling for future sessions. In context, this is more dangerous than a normal config edit because it persists a new command-based server that can later run code and access agent-visible data.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

npx -v

text

2. Add MCP server config in your MCP client configuration (for example `~/.codex/mcp.json`).

```json
{

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

Using npx -y @coinbase/payments-mcp without a pinned version permits implicit installation and execution of the latest published package version. This is risky in a privileged agent environment because it turns routine setup into remote code execution from the package registry with no version control or integrity review.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

Using npx -y @coinbase/payments-mcp without a pinned version permits implicit installation and execution of the latest published package version. This is risky in a privileged agent environment because it turns routine setup into remote code execution from the package registry with no version control or integrity review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.