Security audit

Cost Governor

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent cost-tracking tool, but it asks users to enable autonomous wallet payments and install unreviewed executable code without enough limits or disclosure.

Review this carefully before installing. Use the free/local cost-tracking features only unless you can isolate any payment capability behind a dedicated low-balance wallet, hard signer limits, explicit human approval, and trusted reviewed source code. Do not run the documented npm setup from an unpinned registry package in a sensitive environment without verifying the package provenance and implementation.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

Location: README.md:56
Finding: Installation of an Unreviewed and Unpinned External Package
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:150
Finding: Autonomous Agent Is Instructed to Use a Funded Wallet Without Human Approval
Content: View full analysis
0.5 USDT/month in optimized costs, it pays for itself. No human approval needed. ``` ### Technical Analysis The core cost-monitoring functionality does not require unrestricted signing authority over a funded cryptocurrency wallet. Granting an autonomous agent access to such a wallet expands its privileges from monitoring and budget enforcement to irreversible financial transactions. The documentation explicitly promotes payment without human approval. This removes an independent authorization boundary that could otherwise prevent transactions triggered by prompt injection, compromised dependencies, malformed external content, logic errors, or repeated subscription requests. No documented controls constrain the agent to a dedicated wallet, maximum transaction amount, approved recipient, approved token contract, subscription frequency, or specific chain. No human confirmation, multisignature approval, policy-enforced signer, or revocation procedure is described. ### A ...[truncated 1297 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:167
Finding: Pro License Verification Trusts Unverified Client-Supplied Transaction Hashes
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README promotes autonomous agent payment and subscription behavior with language such as 'No human approval needed' without clearly defining approval boundaries, spending caps, wallet isolation, or explicit opt-in requirements. In a tool that manages costs and integrates payments, this can normalize unsafe financial autonomy and lead to unauthorized or unintended expenditures if operators assume such behavior is safe by default.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README makes a strong privacy/security claim that all data stays local and nothing is sent to external servers, but elsewhere it advertises email/Discord webhooks and x402 payments, which inherently involve outbound network communication. This mismatch can mislead users into enabling the skill under false assumptions about privacy and network behavior, reducing informed consent and potentially exposing usage or financial metadata externally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill prominently encourages autonomous paid subscription and agent self-payment, but the early description does not clearly and explicitly warn operators that enabling this workflow may require granting wallet access and can trigger real, irreversible fund transfers. In this context, the omission is risky because the skill is user-invocable and markets autonomous commerce as a feature, increasing the chance that operators enable financial capabilities without fully understanding the consequences.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.