Security audit

AWS Agents Pay

Security checks for vulnerabilities and agentic risk

Overview

This payment skill is mostly coherent, but it needs Review because its recommended setup can default to feeding untrusted paid content back into the agent.

Review the generated configuration before enabling the plugin. Prefer recipient and origin allowlists, keep per-payment and session budgets low, ensure the runtime role cannot create sessions, and set returnBody/return_body to false unless you deliberately want untrusted paid content in the agent context.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The setup wizard defaults return_body to yes even though the adjacent warning correctly states that paid publisher content may contain prompt injection. In this skill's context, returning purchased content directly into an agent's context weakens the intended trust boundary and can let untrusted remote content influence subsequent tool use or payment decisions.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/bridge.js:40
Evidence: const child = spawn(pythonPath, [bridgePath], {

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: skills/agents-pay/scripts/test_x402_policy.py:316
Evidence: spec.loader.exec_module(cls.admin)