Crypto Payments Saas

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:40 PM UTC
• Version: 1.0.0

Overview

This payment skill is purpose-aligned, but it asks users to rely on a live remote service to generate sensitive billing, webhook, and payout code without enough scoping or security controls described.

Review this before installing. Treat all generated payment, webhook, payout, referral, and scaffolded code as untrusted until manually reviewed. Verify webhook signatures and payment state independently, make fulfillment idempotent, validate amounts and recipients, add audit logs, and require explicit approval for payouts or referral rewards. Avoid running project-assessment tools unless you understand what files and secrets the remote service can access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20
• Finding: Unpinned Remote MCP Service Generates Security-Sensitive Payment Code<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 20-22, 58-72, and 118-135 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash mcporter config add payram --url https://mcp.payram.com/mcp ``` ```bash # Payment creation endpoint (Express) mcporter call payram.snippet_express_payment_route # → /api/pay/create endpoint ready # Next.js billing page mcporter call payram.snippet_nextjs_payment_route # Webhook to fulfill subscriptions mcporter call payram.generate_webhook_handler framework=express # → Handles payment.completed → activate subscription logic # Payout to your team/partners mcporter call payram.generate_payout_sdk_snippet framework=generic-http # Referral program (grow via word of mouth) mcporter call payram.generate_referral_route_snippet framework=express ``` ```bash # Scaffold complete SaaS payment system mcporter call payram.scaffold_payram_app \ language=node \ framework=express \ appName=my-saas-billing \ includeWebhooks=true # Check your project setup mcporter call payram.assess_payram_project # Get go-live checklist mcporter call payram.generate_setup_checklist ``` ### Technical Analysis The Skill instructs users to register a live third-party MCP endpoint and then relies on that endpoint to generate payment routes, webhook handlers, payout integrations, referral functionality, and a complete application scaffold. The remote service is not pinned to an auditable release or immutable artifact. The Skill also provides no integrity verification, response validation, permission restrictions, or mandatory review process for generated output. Consequently, the behavior of these commands can change after the Skill itself has been audited. The repository contains only `SKILL.md`, so the implementation and security properties of the remote MCP tools cannot be inspected locally. This is particularly sensitive because the generated code handles financial transactio ...[truncated 2054 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the MCP server to an auditable, immutable release rather than relying solely on a mutable hosted endpoint. 2. Publish or reference the exact server source revision and provide reproducible deployment instructions. 3. Use cryptographic signatures or integrity verification for generated artifacts where supported. 4. Display all generated code to the user and require explicit approval before writing, installing, executing, or deploying it. 5. Subject generated payment, webhook, and payout code to manual review and automated security testing. 6. Verify webhook signatures, event identifiers, expected networks, payment amounts, recipient addresses, and replay protection independently of generated code. 7. Require explicit confirmation of payout destinations and prevent remote output from silently selecting or changing recipient addresses. 8. Document the permissions, files, environment variables, and project data available to each remote tool. 9. Run the MCP client and generated code with least privilege, restricting filesystem, network, secret, and deployment access. 10. Avoid invoking `assess_payram_project` until its data-access scope and remote data-handling policy are clearly defined. 11. Maintain reviewed local templates for critical financial workflows so a remote response cannot silently replace trusted payment logic. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill encourages use of webhook fulfillment, payouts, and referral automation that can directly change subscription state or move funds, but it does not warn users that these operations are security-sensitive and must be gated by strong verification and reconciliation. In a payments skill, omission of these warnings is dangerous because developers may copy the flow as-is and implement account activation, partner payouts, or billing changes based solely on incoming events, increasing the risk of fraudulent provisioning or unauthorized fund movement.