ClawHub
Back to skill

Security audit

SohoPay

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a real SOHO Pay blockchain helper, but it needs review because it can use a raw wallet private key to send mainnet transactions and some high-impact actions are under-scoped or under-controlled.

Install only after reviewing the contract addresses and use a dedicated wallet with limited funds/allowances. Prefer testnet first, avoid reusing a mainnet wallet private key, and be aware that payment, registration, repayment, and approval transactions may be irreversible and can spend gas or move USDC/credit.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/status.js:58
Finding

Read-Only Status Helper Unnecessarily Requires the Wallet Private Key

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The skill also supports repayment flows and may send approve() transactions for USDC allowances, which is a meaningful fund-authorization capability beyond simple payment initiation. Even if payment execution uses EIP-712 in one path, the overall skill still exercises broader direct transaction authority than advertised.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill also supports repayment flows and may send approve() transactions for USDC allowances, which is a meaningful fund-authorization capability beyond simple payment initiation. Even if payment execution uses EIP-712 in one path, the overall skill still exercises broader direct transaction authority than advertised.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill also supports repayment flows and may send approve() transactions for USDC allowances, which is a meaningful fund-authorization capability beyond simple payment initiation. Even if payment execution uses EIP-712 in one path, the overall skill still exercises broader direct transaction authority than advertised.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill also supports repayment flows and may send approve() transactions for USDC allowances, which is a meaningful fund-authorization capability beyond simple payment initiation. Even if payment execution uses EIP-712 in one path, the overall skill still exercises broader direct transaction authority than advertised.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
94% confidence
Finding

The lockfile pins transitive dependency ws to 8.17.1, and the finding cites known advisories for memory disclosure and memory-exhaustion denial of service in that version. Even though this skill is focused on EIP-712 payment signing and ws is brought in through ethers, a vulnerable WebSocket library can still expose the process to remote attacks if any websocket-based provider or connection path is used.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script directly submits on-chain approve() and repay() transactions using the caller's wallet, which materially differs from the stated skill purpose of initiating payments via EIP-712 signatures. This mismatch is dangerous because a user expecting an off-chain signature flow may instead grant token allowance and execute irreversible state-changing transactions, increasing the risk of unintended fund movement and deceptive wallet use.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill explicitly requires a sensitive environment variable (PRIVATE_KEY) and uses it to sign blockchain authorizations and transactions, but the manifest does not declare any tool scope or permission boundary for environment access. That omission weakens reviewability and least-privilege controls, making it easier for an agent runtime to grant broader secret access than operators expect.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill’s stated purpose is payment initiation via EIP-712, but it also sends an unrelated state-changing on-chain registration transaction when the signer is not registered or active. This creates a hidden side effect that can spend gas, alter account state, and enroll the user in a protocol flow they did not explicitly authorize, which is dangerous in a wallet/agent context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script broadcasts registerAgent immediately after a failed pre-flight check without any confirmation prompt or upfront warning. That means a user invoking a payment script may unknowingly trigger a separate on-chain transaction, incurring gas costs and changing protocol state with no final consent gate.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Automatic agent registration is not necessary to merely construct or submit a payment authorization and broadens the skill’s authority beyond its declared scope. In an agent setting, this can be abused to induce users to sign or broadcast unexpected transactions under the guise of a payment flow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script requires a raw PRIVATE_KEY from the environment and constructs a Wallet capable of broadcasting transactions, despite the skill being described as EIP-712-based payment initiation. This is dangerous because it expands the trust boundary from message signing to full transaction authority, exposing users to key-handling risk and enabling direct asset movement if the script behavior is misunderstood or modified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This script performs only read-only blockchain queries, but it unnecessarily requires a PRIVATE_KEY and instantiates a wallet from it. That expands secret exposure for no operational need: users may load a live signing key into an environment, shell history, CI job, or agent runtime just to check status, increasing the risk of accidental leakage or downstream misuse.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency uses a caret range, which permits automatic installation of newer minor and patch releases instead of a single reviewed version. In a payment-signing skill, this increases supply-chain risk because compromised or breaking upstream releases in a cryptography or transaction library could affect signing, transaction construction, or secret handling.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json
"pay": "node scripts/pay.js"
  },
  "dependencies": {
    "ethers": "^6.13.0",
    "dotenv": "^16.0.0"
  },
  "engines": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
90% confidence
Finding

The dotenv dependency is also version-ranged with a caret, allowing unreviewed updates to be pulled in during installation. While lower risk than a signing library, this still creates avoidable supply-chain exposure in a skill likely handling private keys, RPC URLs, or payment configuration via environment variables.

Content

Scanner excerpt · package.json (reported line 11)May include surrounding context.

json
},
  "dependencies": {
    "ethers": "^6.13.0",
    "dotenv": "^16.0.0"
  },
  "engines": {
    "node": ">=18.0.0"

Static analysis

No suspicious patterns detected.