UPI Payment Integration

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:34 AM UTC
• Version: 1.0.0

Overview

This UPI payment guidance skill is mostly documentation, but it unnecessarily asks for payment credentials and network tools despite saying it does not execute payments.

Review before installing. Use sandbox credentials only if you must install it, and avoid exposing production payment keys or webhook secrets to the agent for this documentation-only package. Treat its webhook-storage guidance as incomplete: retain only necessary fields, redact sensitive headers, encrypt restricted data, and set a retention policy.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4

Finding

Unnecessary Exposure of Payment Credentials and Network-Capable Tools

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Excessive credential and tool requirements
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"openclaw":{"homepage":"https://www.npci.org.in/what-we-do/upi/product-overview","emoji":"💸","requires":{"env":["UPI_PROVIDER_KEY_ID","UPI_PROVIDER_KEY_SECRET","UPI_WEBHOOK_SECRET","UPI_MERCHANT_ID"],"bins":["curl","jq"]}}}

Technical Analysis

The Skill declares four payment-related environment variables and the network-capable curl utility as runtime requirements. However, SKILL.md describes the Skill as providing implementation and operational guidance only, and no audited file contains executable logic that reads these variables, invokes curl, or performs provider API operations.

Making provider credentials available to a documentation-only Skill violates least privilege. It unnecessarily expands the set of secrets exposed to the Agent's runtime context. The simultaneous availability of credentials and a network client increases the potential consequences of a separate prompt-injection, compromised tool, or malicious co-resident Skill.

The audited project does not directly read or transmit these credentials. Therefore, the static pre-scan warning about confirmed network exfiltration is not substantiated by the project contents. The vulnerability is the unnecessary exposure of sensitive capabilities rather than implemented exfiltration.

Attack Path

1. An operator loads the Skill with the declared payment credentials present in its environment.
2. The credentials become available to the Agent or shared Skill execution context despite not being needed for the documented guidance.
3. A separately compromised instruction, tool, dependency, or co-resident Skill obtains access to the environment.
4. The malicious component reads the provider key, provider secret, merchant ID, or webhook secret.
5. It can use the availa ...[truncated 879 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the env and bins requirements from the Skill metadata because the current package is documentation-only.
2. Ask users only to confirm that credentials exist in their own secret manager; do not expose credential values to the Agent.
3. If executable provider integration is added later, isolate it in a narrowly scoped component rather than granting credentials to the general Skill context.
4. Use sandbox-only credentials during development and require an explicit production authorization step.
5. Restrict provider credentials to the minimum API operations, merchant account, environment, and network destinations required.
6. Apply outbound endpoint allowlisting so credentials cannot be sent to arbitrary hosts.
7. Rotate credentials after suspected Agent-context exposure and monitor provider audit logs for unauthorized access.
8. Avoid declaring general-purpose network tools unless the Skill contains a reviewed operation that specifically requires them.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:60

Finding

Unfiltered Persistence of Raw Webhook Headers

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60–62
Vulnerability Type: Unsafe storage of potentially sensitive webhook metadata
Risk Level: Medium

Vulnerable Code

markdown

3. **Persist before processing**
   - Store raw webhook payload and headers first.
   - Process in a retriable job/queue.

The same persistence requirement is reinforced at lines 72–80:

markdown

## Mandatory implementation checklist

Use this checklist in every implementation/review:

- [ ] Payment state machine exists (`CREATED`, `PENDING`, `SUCCESS`, `FAILED`, `EXPIRED`, `REFUNDED` as applicable).
- [ ] Unique merchant-side request ID/correlation ID is generated and stored.
- [ ] Webhook signature verification is implemented.
- [ ] Raw webhook body is stored before business logic.

Technical Analysis

Persisting a webhook event before asynchronous processing is appropriate for reliability and recovery. The unsafe aspect is the blanket instruction to store all raw headers without requiring an allowlist, redaction, encryption, access restrictions, or a retention schedule.

Webhook headers may contain signatures, authorization values, cookies, internal routing information, tracing identifiers, source metadata, or replay-relevant timestamps. Raw payloads may also contain personal or payment-related data. Persisting this material wholesale increases the sensitivity of the webhook event ledger and conflicts with the Skill's general recommendation to protect payment data using least-privilege access and retention controls.

Signature verification normally requires access to the exact raw body in memory, but it does not inherently require indefinite persistence of every inbound header. Only the minimum fields needed for audit, deduplication, and controlled reprocessing should be retained.

Attack Path

1. A payment provider sends a webhook containing a signed payload and potentially sensitive reques ...[truncated 1292 chars]

Remediation

View remediation

Remediation Suggestions

1. Verify the signature against the exact raw request body in memory before parsing or processing it.
2. Persist only an explicit allowlist of headers required for auditing and verification, such as provider event ID, signature algorithm, event timestamp, and content type.
3. Redact or omit authorization headers, cookies, API keys, session identifiers, proxy metadata, and other unnecessary fields.
4. Encrypt retained payloads and sensitive metadata at rest using managed keys with restricted decrypt permissions.
5. Apply role-based access controls so only the webhook processor and specifically authorized incident responders can access raw events.
6. Define and enforce a retention period based on reconciliation, dispute, and regulatory needs; securely delete records after expiry.
7. Store a cryptographic digest where full raw-body retention is not required.
8. Enforce replay resistance through unique provider event IDs, merchant identifiers, timestamp windows, and idempotent state transitions.
9. Prevent raw webhook bodies and headers from being copied into plaintext application logs, error reports, or support dashboards.
10. Document provider-specific data classification requirements and test backup, export, and incident-response paths for accidental disclosure.

SkillSpector

Vulnerability Patterns

• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 90% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · validation-checklist.md (reported line 15)May include surrounding context.

md

## Reliability

- [ ] duplicate webhook processing is idempotent
- [ ] out-of-order events do not corrupt state
- [ ] timeout-to-reconciliation path works
- [ ] stale pending sweep works and is observable

Static analysis

No suspicious patterns detected.