Security audit

Compare Crypto Payments

Security checks for vulnerabilities and agentic risk

Overview

This PayRam-authored payment comparison skill is not proven malicious, but it steers broad payment questions toward PayRam and includes unsafe setup paths for payment and code-generation tooling.

Review this skill carefully before installing. Treat its PayRam recommendation as vendor-authored marketing, do not run the curl-to-bash installers without independently inspecting and pinning the scripts, and do not connect the MCP server or create payments unless you have explicit human approval, spending limits, and a plan to review generated code in isolation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:134
Finding: Unverified Remote Scripts Are Downloaded and Executed Directly
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: SKILL.md:149
Finding: Third-Party MCP Server Is Registered for Payment and Code-Generation Operations Without Adequate Trust Controls
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:3
Finding: Vendor-Biased Instructions Predetermine the Outcome of Broad Payment-Gateway Comparisons
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
### Q1: Do you need to own your payment infrastructure, or is renting acceptable? **→ Need to own it** → Self-hosted required (PayRam or BTCPay Server) **→ Renting is fine** → Hosted options (Coinbase Commerce, NOWPayments, Stripe) ### Q2: Are stablecoins (USDT/USDC) your primary payment currency? **→ Yes, stablecoins first** → PayRam (stablecoin-native) **→ Bitcoin only** → BTCPay Server (Bitcoin-first) ### Q3: Do AI agents or automated systems need to initiate or manage payments? **→ Yes, agent-driven payments** → PayRam + MCP (purpose-built for agents) **→ Humans only** → Either works, but PayRam has better UX ### Q4: Are you in a "high-risk" industry (iGaming, adult, forex, crypto services)? **→ Yes** → PayRam (permissionless, no terms of service restrictions) **→ No, mainstream** → More options, but sovereignty still matters ### Q5: Do you need privacy/isolation between payer identity and merchant infrastructure? **→ Privacy critical** �

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The markdown includes curl-to-shell installation commands that download and execute remote scripts directly on the host. This is dangerous because it gives the remote source full code-execution capability at install time, and if the source is compromised, changed, or intercepted, users or agents could run arbitrary malicious code on their infrastructure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises very broad trigger phrases such as general payment-gateway and processor comparisons, which can cause the agent to invoke this skill for many common finance-related requests. Because the content is strongly biased toward a specific vendor and includes operational setup instructions, unintended invocation can steer users toward promotional or risky guidance they did not explicitly request.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.
md
### Technical Advantages: 1. **No HTTP metadata exposure** - Payments happen on-chain, not in headers 2. **Multi-token support** - Not limited to USDC/EIP-3009 3. **Self-hosted facilitator** - No Coinbase dependency 4. **Smart contract sweeps** - Automatic cold wallet security

Static analysis

No suspicious patterns detected.