Payment Gateway Payram

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:39 PM UTC
• Version: 1.0.0

Overview

The skill is mostly a payment-integration guide, but it includes an unsafe production install command that runs mutable remote shell code without verification.

Review this skill before installing. The remote MCP usage is disclosed, but avoid running the self-hosting curl-to-bash command unless you first download the script, inspect it, pin it to a trusted commit or release, and verify its integrity. Be especially careful because this skill concerns payment and payout infrastructure.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:122

Finding

Unverified Remote Shell Script Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 122
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/PayRam/payram-scripts/main/setup_payram.sh)"

Technical Analysis

The self-hosting instructions retrieve a shell script from an external GitHub repository and pass its contents directly to Bash. The URL references the mutable main branch rather than a reviewed commit or immutable release artifact.

The command provides no checksum verification, cryptographic signature validation, local inspection step, or confirmation before execution. Consequently, the effective payload may change after this Skill has been reviewed. GitHub hosting alone does not establish the integrity or safety of the downloaded code, and the remote script was not included in the audited project.

This installation method is not the minimum-privilege approach necessary to provide the declared payment integration. It grants an externally controlled payload all permissions available to the user running the command.

Attack Path

1. An attacker compromises the upstream GitHub account or repository, or an upstream maintainer maliciously changes setup_payram.sh.
2. The attacker adds arbitrary shell commands to the script on the mutable main branch.
3. A user follows the Skill's documented self-hosting procedure.
4. curl downloads the modified content without verifying its identity or integrity.
5. /bin/bash executes the content immediately under the invoking user's account.
6. The payload accesses or modifies any resources available to that account and may download additional components.

Impact Assessment

Successful exploitation permits arbitrary command execution with the privileges of the invoking user. Depending on that user's access and environment, the payload could:

• Read credentials, API tokens, SSH keys, or cryptocurre ...[truncated 578 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct pipe-to-shell execution pattern.
2. Publish a versioned release artifact and pin installation instructions to a reviewed immutable version or commit.
3. Provide a cryptographic SHA-256 checksum and, preferably, a maintainer signature using a documented verification key.
4. Download the installer to a local file, verify it, and allow the user to inspect it before execution. For example:

bash

curl -fL -o setup_payram.sh \
  https://raw.githubusercontent.com/PayRam/payram-scripts/REVIEWED_COMMIT/setup_payram.sh

printf '%s  %s\n' 'EXPECTED_SHA256' 'setup_payram.sh' | sha256sum --check -
less setup_payram.sh
bash setup_payram.sh

5. Vendor the reviewed installer into the Skill package where practical so that the audited code matches the executed code.
6. Document all files, network endpoints, services, ports, and permissions the installer requires.
7. Ensure the installer runs without elevated privileges by default. If a specific privileged operation is unavoidable, isolate it, explain it, and request confirmation only at that step.
8. Avoid exposing payment credentials or wallet material to the installer, and recommend execution in an isolated test environment before production use.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation presents a curl-piped bash command as a production setup path without any warning about the risks of executing unaudited remote shell content. This omission materially increases the likelihood that users will run arbitrary code directly from the network, enabling compromise if the source, repository, transport, or referenced script is malicious or later altered.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are very broad and overlap with many ordinary payment-related requests, increasing the chance the skill is invoked in contexts the user did not specifically intend. Because this skill can direct users toward external infrastructure and code-generation/install flows, over-broad activation raises the risk of unintended exposure to risky instructions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs users to execute a curl-piped bash installer from a remote GitHub URL, which grants arbitrary code execution with the user's privileges and is much broader than a normal payment-integration documentation step. In a skill ecosystem, this is especially dangerous because users may treat setup commands as trusted and execute them without reviewing the fetched script.

Content

No source excerpt is available for this finding.