ClawHub
Back to skill

Security audit

PayRam MCP Integration

Security checks for vulnerabilities and agentic risk

Overview

This skill fits a crypto-payment setup purpose, but it needs review because it directs agents to run unverified remote scripts, handle passwords and wallet mnemonics, and automate wallet and contract operations.

Install only after carefully reviewing the external PayRam scripts at a pinned version, and avoid running the headless or self-host commands in a production or wallet-bearing environment. Use testnet funds first, keep PayRam passwords and wallet mnemonics out of shell history and project files where possible, confirm destination addresses and chain choices manually, and treat any exposed mnemonic as compromised.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:132
Finding

Mutable Remote Installation Script Is Downloaded and Executed Without Verification

Content
View full analysis
Remediation
View remediation
setup_payram.sh" | sha256sum --check ``` 5. Cryptographically sign releases and require signature verification using a documented trusted signing key. 6. Instruct users to inspect the downloaded script before running it. 7. Vendor the reviewed installation script in the Skill package where practical. 8. Run installation with the least privileged dedicated account and avoid requesting root access unless a documented operation strictly requires it. 9. Separate optional self-hosting installation from the minimal hosted MCP connection workflow. ]]>

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:104
Finding

Unpinned External Repository Scripts Receive Credentials and Perform Wallet Operations

Content
View full analysis
Remediation
View remediation
``` 2. Verify the commit or release signature against a documented trusted maintainer key. 3. Publish and verify checksums for all scripts and contract artifacts. 4. Include security-relevant scripts and contract source in the auditable Skill package where possible. 5. Separate authentication, wallet generation, and contract deployment into distinct, explicitly approved steps. 6. Do not expose passwords through long-lived shell environment variables. Use protected standard input, an OS credential store, or a dedicated secret manager. 7. Run setup in a restricted container or dedicated low-privilege account with narrowly scoped filesystem and network access. 8. Present and require confirmation of wallet addresses, fund-collector destinations, chain identifiers, and contract bytecode hashes before deployment. 9. Ensure production wallet operations use a hardware wallet or external signer rather than exposing mnemonic material to general-purpose setup scripts. 10. Document every external endpoint contacted and allow users to restrict outbound traffic accordingly. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
references/headless-setup.md:23
Finding

Authentication Tokens and Wallet Mnemonics Are Persisted in Plaintext Project Files

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The headless setup instructs users to export credentials and run a fully non-interactive script that creates wallets and deploys contracts, yet provides no warning about financial risk, secret handling, irreversible on-chain actions, or environment isolation. In the context of an agent skill, omission of these warnings materially increases the chance of unsafe autonomous execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Piping a remote script directly into bash without any warning is a classic arbitrary-code-execution hazard. Because this skill targets payment and agent infrastructure, successful compromise could expose credentials, alter payout logic, steal wallet material, or persist malware on hosts likely to hold sensitive financial data.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The skill documents use of a mnemonic and token files stored in predictable local paths and environment variables, which are highly sensitive credentials for wallet control and authenticated API access. In an agent skill context, normalizing plaintext secret handling increases the chance that automation, logs, shell history, or other tools expose credentials that could enable account takeover or theft of crypto assets.

Content

Scanner excerpt · references/headless-setup.md (reported line 52)May include surrounding context.

md
| `PAYRAM_FUND_COLLECTOR` | deployer address | Cold wallet 0x (40 hex). Omit or leave empty to use deployer address from mnemonic. |
| `PAYRAM_SCW_NAME` | `Headless SCW` | Name for the SCW wallet |
| `PAYRAM_BLOCKCHAIN_CODE` | `ETH` | e.g. ETH, BASE, POLYGON |
| `PAYRAM_MNEMONIC` | — | Or mnemonic in `.payraminfo/headless-wallet-secret.txt` |

Token is read from `.payraminfo/headless-tokens.env` (created by signin). Deploy-scw uses mnemonic from that file or `PAYRAM_MNEMONIC`.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The documentation explicitly identifies the secret-bearing files for tokens and wallet mnemonic storage, which can guide an attacker or unsafe automation toward high-value credential targets. Because this skill is for headless/CLI automation of crypto payments, compromise of these files could directly enable unauthorized API actions or wallet deployment/use tied to financial operations.

Content

Scanner excerpt · references/headless-setup.md (reported line 93)May include surrounding context.

md
## Files and scripts

- **Token / secrets:** `.payraminfo/headless-tokens.env`, `.payraminfo/headless-wallet-secret.txt` (mnemonic). Do not commit.
- **Scripts:** `scripts/generate-deposit-wallet.js` (BTC), `scripts/generate-deposit-wallet-eth.js` (ETH xpub), `scripts/deploy-scw-eth.js` (SCW deploy). Run via headless commands; deploy-scw is invoked by `./agent_headless.sh deploy-scw`.

---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description embeds trigger phrases such as 'accept crypto payments', 'create payment link', and especially 'PayRam', which are broad enough to overlap with ordinary user requests or mere mentions of the product. The file does not provide exclusion conditions or negative examples to clarify when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill advertises 'no KYC / no signup / no account' and then later provides headless instructions requiring PAYRAM_EMAIL and PAYRAM_PASSWORD plus automated wallet creation and contract deployment. This creates a deceptive trust boundary: an agent or user may treat the skill as low-risk integration guidance when it actually enables credentialed account operations and autonomous financial setup with minimal warning.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The self-hosted path executes a remote shell script via curl piped to bash, which grants arbitrary code execution from a network-fetched resource. In a skill intended for payment integration, this is especially dangerous because operators may run it on production hosts handling secrets, wallets, or payment infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation includes a destructive reset-local command that wipes local database and API data, but it does not present a strong inline warning about irreversible data loss at the command definition itself. In an agent/automation context, terse operational docs can lead to accidental execution, causing availability loss and destruction of local payment configuration, wallets, or test data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.