StablePay Agent Bootstrap

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:03 AM UTC
• Version: 1.4.0

Overview

This setup skill is coherent, but it asks users to run and optionally persist an unpinned npm package during wallet/payment onboarding.

Review this skill before installing. Use a pinned, verified version of stablepay-agentpay-dev, avoid global install unless necessary, do not configure the MCP server until you trust the exact package being run, and be careful with wallet identity, payment limits, and publish commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:59

Finding

Unpinned Third-Party npm Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:59-74, SKILL.md:82-86, and SKILL.md:131-138
Vulnerability Type: Unpinned and mutable third-party dependency execution
Risk Level: Medium

The Skill instructs the agent to install and execute stablepay-agentpay-dev without specifying an audited version or integrity digest. It also configures the package as an MCP server, allowing the mutable package to be executed in later sessions.

bash

# Windows
npm.cmd install -g stablepay-agentpay-dev

# Linux/macOS/WSL
npm install -g stablepay-agentpay-dev

bash

# Windows
npx.cmd stablepay-agentpay-dev doctor

# Linux/macOS/WSL
npx stablepay-agentpay-dev doctor

bash

# Windows
npx.cmd stablepay-agentpay-dev onboard --interactive

# Linux/macOS/WSL
npx stablepay-agentpay-dev onboard --interactive

json

{
  "mcpServers": {
    "stablepay": {
      "command": "npx",
      "args": ["stablepay-agentpay-dev", "mcp"]
    }
  }
}

Technical Analysis

npm commands without an explicit version resolve the package through the configured npm registry and generally select the registry's current applicable release. Consequently, the code executed by this Skill can differ from the code that was reviewed.

The instructions do not require verification of the package publisher, exact version, provenance, integrity hash, lockfile, or package contents. Global installation may also execute npm lifecycle scripts and place package-controlled executables in a global binary directory. The MCP configuration preserves the same unpinned resolution behavior and can cause future agent sessions to invoke a newer, unreviewed package version.

This creates a supply-chain trust boundary in which compromise of the package publisher, registry account, distribution channel, or a future package release could introduce arbitrary code. No evidence establishes that the current package is malicio ...[truncated 1878 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every installation and execution to an explicitly reviewed version, for example:

   bash

   npm install -g stablepay-agentpay-dev@1.4.0
   npx --yes stablepay-agentpay-dev@1.4.0 doctor
   

2. Verify the selected package version's publisher, provenance, registry metadata, tarball contents, and integrity digest before authorizing execution.
3. Prefer a lockfile-backed local installation or an internally mirrored, approved artifact over resolving the package dynamically during every invocation.
4. Configure MCP to invoke a locally installed and verified executable rather than an unversioned npx package:

   json

   {
     "mcpServers": {
       "stablepay": {
         "command": "/verified/path/to/stablepay-agentpay-dev",
         "args": ["mcp"]
       }
     }
   }
   

5. Avoid global installation unless it is operationally required. Run the package as a non-privileged user and within a restricted environment that limits filesystem, secret, wallet, and network access.
6. Review package lifecycle scripts before installation. Where compatible with the package, disable lifecycle scripts during dependency retrieval and explicitly run only reviewed setup actions.
7. Establish an update process requiring security review and integrity verification before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill repeatedly instructs the agent to execute an unpinned package via npx, which fetches and runs whatever version is current in the registry at execution time. This creates a supply-chain execution risk: a compromised maintainer account, malicious new release, dependency hijack, or typo-squatted replacement could lead to arbitrary code execution in the agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill directs global installation and later includes publish steps that modify system and registry state, but it does not require an explicit warning or confirmation before performing these side-effecting actions. In an agent-executed context, this can lead to unintended host modification, persistence, PATH changes, or accidental package publication under a user's credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This invocation uses npx stablepay-agentpay-dev without a version pin, so the executed code is not stable or reviewable from the skill alone. In a skill whose purpose is bootstrapping and configuring tooling, that means the first-run trust boundary is the public registry, making compromise or malicious updates directly executable.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The onboarding command executes remote package code without pinning a version, and onboarding flows commonly handle credentials, wallet linkage, and configuration state. If a malicious or compromised package version is pulled, it could exfiltrate secrets, alter wallet setup, or persist malicious MCP configuration.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The MCP server configuration instructs the runtime to launch npx with an unpinned package name, allowing future executions to resolve to whatever version is current at that time. This is particularly risky because MCP servers often receive ongoing access to agent context, prompts, and local capabilities, turning a supply-chain issue into persistent privileged code execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This specific MCP args entry contains the unpinned package name that will be resolved by npx at runtime. Because MCP configuration is typically persisted and reused, the risk is amplified: later sessions may silently run a newly published package version with access to agent communications and local environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The post-publish smoke test relies on npx stablepay-agentpay-dev without a version pin, so validation may execute a different package version than the one just published or reviewed. This weakens release assurance and can mask or introduce malicious behavior through registry-side changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This smoke-test onboarding command executes an unpinned package from the registry during a sensitive workflow. Because onboarding may involve wallet identity details and verification steps, a compromised package version could tamper with setup or collect sensitive data under the guise of normal validation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The status smoke test also resolves the package dynamically from the registry, creating the same supply-chain execution issue as the other npx examples. In aggregate, the skill normalizes repeated unpinned remote execution, increasing the chance an operator or agent will run unreviewed code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.