Security audit

penny-web-search

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it combines paid wallet-enabled web requests with unpinned command execution and broad activation guidance that deserves review before use.

Review before installing. Use only with a low-risk wallet, confirm each paid call, avoid sending secrets or private business data in queries, and pin or otherwise verify the AgentCash and skills CLI versions instead of copying the npx @latest examples directly.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

Location: SKILL.md:94
Finding: Unpinned Third-Party CLI Packages Are Downloaded and Executed
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The README instructs users to run npx skills add ... without pinning an exact package version. Because npx resolves and executes the latest published package by default, a compromised upstream package, malicious update, or dependency confusion event could cause arbitrary code execution on the user's machine during installation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The command npx agentcash@latest check ... executes a remotely fetched package version determined at runtime. Even though @latest is explicit, it is still unpinned and can change over time, so a malicious or compromised release could run attacker-controlled code in the user's environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README again tells users to run npx agentcash@latest add ..., which fetches and executes whatever package is current at the time. In a security-sensitive skill involving paid API calls and persistent configuration, this increases exposure because a compromised package could alter local settings, exfiltrate secrets, or redirect future requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list is broad enough to match common requests such as general research, verification, or current information, which can cause the skill to activate in many ordinary conversations. In this skill's context, over-triggering is dangerous because activation can lead to paid external network calls and disclosure of user queries to a third-party service without sufficiently specific user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Although pricing is described elsewhere, the operational routing/use guidance does not provide a clear user-facing warning at the decision point that invoking the skill results in paid network requests to an external service. That increases the chance of unauthorized spend and unintended sharing of user queries or business-search terms with the third party.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs use of npx agentcash@latest, which pulls and executes the latest package version at runtime rather than a pinned, reviewed release. If the upstream package is compromised or a breaking version is published, an agent following this skill could execute attacker-controlled code and potentially expose wallet, payment, or environment secrets.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This invocation again uses npx agentcash@latest, creating a supply-chain execution path where the fetched CLI version can change without notice. In this skill, that risk is amplified because the tool is explicitly used to perform x402 payment handling and wallet-signing flows, increasing the value of compromising the runtime.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Using npx agentcash@latest discover permits dynamic execution of whatever package version is current when the command runs. Because discovery is performed against a payment-enabled service endpoint, compromise of the CLI could lead to unauthorized requests, credential theft, or manipulation of payment-related behavior.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This npx agentcash@latest add command has the same unpinned remote-package execution problem and additionally persists trust/configuration for later reuse. A malicious or compromised package could implant unsafe configuration, alter future payment behavior, or establish persistence in the agent environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The documentation instructs users to run npx agentcash@latest, which fetches and executes the newest published package version at runtime rather than a reviewed, immutable version. If the npm package, publisher account, or dependency chain is compromised, users could execute attacker-controlled code on their systems, and the payment-enabled wallet context increases the potential severity.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx agentcash@latest discover https://pennyregwatch.com causes users to execute whatever package version is current at the time of invocation, creating a supply-chain execution risk. In this skill, that risk is amplified because the tool is used to discover and interact with payment-capable infrastructure, potentially exposing wallet-related operations to a malicious package.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The example npx agentcash@latest check ... again relies on an unpinned package version, so users may unknowingly run newly published code without prior review. Because this command is part of the getting-started flow and likely to be copied verbatim, it creates a realistic path for supply-chain compromise affecting many users.
Content: No source excerpt is available for this finding.