Crypto payments for agents and humans, full stack with Payram

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:47 PM UTC
• Version: 1.0.0

Overview

This skill is payment-focused and mostly coherent, but it asks users or agents to run an unpinned external MCP server and use codebase-scanning/scaffolding tools for sensitive payment flows without enough scoping or safeguards.

Review before installing. Use this only when you explicitly intend to integrate PayRam, run the MCP server in a sandbox or disposable development environment, pin the referenced repository to a reviewed commit, avoid exposing unrelated secrets or wallet credentials, and use a clean branch before project assessment or scaffolding.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:34
• Finding: Unpinned Third-Party Repository and Dependency Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 34-40 **Vulnerability Type**: Unpinned external code and dependency installation **Risk Level**: High ### Vulnerable Code ```bash # Clone and run MCP server git clone https://github.com/PayRam/payram-helper-mcp-server cd payram-helper-mcp-server yarn install && yarn dev # Server runs at http://localhost:3333/mcp ``` ### Technical Analysis The installation instructions clone the current state of a mutable third-party Git repository without specifying a reviewed commit hash, signed tag, or immutable release artifact. They then install its dependencies and execute the resulting application. `yarn install` may execute package lifecycle scripts from direct or transitive dependencies. The subsequent `yarn dev` command directly runs code retrieved from the external repository. No integrity verification, immutable-lockfile requirement, lifecycle-script restriction, or execution isolation is documented. As a result, the code executed by users may differ from the code that existed when this Skill was reviewed. A compromise of the external repository, package-publishing accounts, or any eligible dependency could introduce arbitrary executable behavior. The audit found no evidence that the referenced repository or its dependencies are currently malicious; the vulnerability is the unsafe, unpinned trust and execution model. ### Attack Path 1. An attacker compromises the referenced repository, a maintainer account, or a direct or transitive dependency. 2. The attacker adds malicious application code or a package lifecycle script. 3. A user follows the Skill instructions and clones the mutable default branch. 4. The user runs `yarn install`, causing dependencies and potentially attacker-controlled lifecycle scripts to execute. 5. The user runs `yarn dev`, executing the downloaded application with the user's local privileges. 6. The malicious code accesses resources available to that process, pote ...[truncated 912 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the external repository to a reviewed full commit hash or cryptographically signed release instead of cloning a mutable default branch. 2. Publish and verify checksums or signatures for approved release artifacts. 3. Require a committed dependency lockfile and use an immutable installation mode, such as the applicable Yarn option that rejects lockfile changes. 4. Review all direct and transitive dependencies before deployment and add automated dependency and provenance scanning. 5. Disable package lifecycle scripts during installation where feasible, enabling only explicitly reviewed scripts when required. 6. Run the MCP server in a dedicated, least-privilege container or sandbox with: - A non-root user. - A read-only filesystem where practical. - No unnecessary host-directory mounts. - Restricted outbound network access. - No wallet secrets or unrelated API credentials. 7. Separate development and production credentials, and expose only the minimum environment variables required by the server. 8. Document a reproducible upgrade and re-review process for every repository or dependency version change. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill description is extremely broad and markets itself for many payment-related use cases, including high-risk and no-KYC contexts, which increases the chance an agent will invoke it for loosely related requests. Over-broad invocation language can cause unintended tool selection and expose users to risky payment-generation, deployment, or integration workflows without sufficiently explicit user intent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs users to assess a codebase and scaffold full applications, including payment creation, payouts, webhook handling, and a web console, but does not warn that these actions may read existing repositories and create or modify files. In an agentic setting, this can lead to unexpected repository changes, generated code insertion, or expansion of a sensitive payment-handling surface without explicit confirmation.

Static analysis

No suspicious patterns detected.