Security audit

PayAll CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a financial automation helper, but it gives agents access to private wallet keys, full card details, and confirmation-skipping fund transfers without enough safeguards.

Review carefully before installing. Only use this skill if you trust the Payall CLI publisher and are comfortable giving an agent access to wallet signing, card details, and transaction commands. Do not paste private keys into chat or command arguments, avoid --yes for any transfer or withdrawal, verify every destination address and amount yourself, and avoid revealing full card details unless strictly necessary.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

Location: SKILL.md:14
Finding: Unpinned Global Installation of a Security-Critical External Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:26
Finding: Wallet Private Key Exposed Through Command-Line Arguments and Persistent Storage
Content: View full analysis
# Non-interactive login — key auto-saved (use this for agents) payall auth login --invite XYZ # Include referral code (first-time only) payall auth status # Show current session info payall auth logout # Clear session, credentials, and saved key ``` The private key is signed locally and never sent to the server. When `--key` is passed, the key is automatically saved (AES-256-GCM encrypted) so subsequent wallet commands work without re-entering it. ``` The unsafe agent workflow is repeated at lines 171-172: ```markdown If no saved key is found, wallet commands prompt for the private key interactively and offer to save it. For agents, ensure the key is saved first via `payall auth login --key `. ``` ### Technical Analysis The skill explicitly recommends passing a wallet private key in a command-line argument and automatically persisting it for subsequent commands. Command-line arguments are not a suitable channel for high-value secrets because they may be captured in: - Shell history. - Process listings and process-monitoring tools. - Terminal session recordings. - Agent tool-call transcripts and retained conversation context. - Debug logs, telemetry, crash reports, or command audit systems. - Wrapper scripts and orchestration platforms. The claim that the saved key uses AES-256-GCM does not by itself establish secure storage. The project does not contain the implementation, so the encryption key derivation, nonce management, authentication-tag validation ...[truncated 1563 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:70
Finding: Full Payment-Card Credentials Exposed to Agent Context in Machine-Readable Form
Content: View full analysis
# Masked card number, CVV, billing address payall cards detail --reveal # Full card number, CVV, expiry, billing address payall cards detail --reveal --json # JSON output (for agents) ``` The `--reveal --json` output returns all fields an agent needs to fill payment forms: ```json { "card_name": "Bit2Go", "card_number": "4474200012345678", "card_cvv": "123", "expiry_month": 10, "expiry_year": 2027, "card_bin": "44742000", "first_name": "John", "last_name": "Smith", "address": "3500 South DuPont Highway", "city": "Dover", "state": "DE", "zipcode": "19901", "country_code": "USA" } ``` ### Technical Analysis The skill provides an agent-specific command that returns the full primary account number, CVV, expiration date, cardholder name, and billing address as JSON. This exposes the complete set of information commonly needed for card-not-present transactions. Machine-readable output is likely to enter agent context, tool traces, application logs, observability systems, transcript retention, or connected model services. The data therefore crosses more trust boundaries than necessary. The skill does not require a trusted isolated interface, explicit reauthentication, output redaction, restricted retention, or confirmation immediately before disclosure. Even the nominally masked command is documented as returning a CVV, which should be treated as highly sensitive authentication data and should not be displayed or retained unnecessarily. ### Attack Path 1. An agent or user invokes `payall cards detail --reveal --json`. 2. The CLI returns the full card number, CVV, expiration date, identity details, and billing address. 3. The output is i ...[truncated 825 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:174
Finding: Irreversible Financial Transactions Bypass Explicit User Confirmation
Content: View full analysis
` — `0x...` (40 hex chars) for EVM, `T...` (34 chars, Base58) for TRON - `--amount ` — USDT amount - `--chain ` — `bsc`, `eth`, or `tron` - `-y, --yes` — Skip confirmation ``` The automated workflow at lines 191-198 further directs agents to send funds without confirmation: ```markdown 1. payall cards my # Get binding_id 2. payall cards topup --amount 50 --chain tron --yes # Get deposit address 3. payall wallet balance # Check which chain has funds 4. payall wallet send --to --amount 50 --chain tron --yes # Send USDT ``` ### Technical Analysis The skill recommends using `--yes` to suppress confirmation for wallet sends, card top-ups, applications, and withdrawals. These are high-impact financial operations, and blockchain transfers are normally irreversible. The destination can be taken from CLI or backend output and then passed directly into another non-interactive command. The workflow does not require the user to independently verify the complete destination address, chain, token, amount, and fee immediately before signing. It also provides no documented address allowlist, spending cap, transaction simulation, out-of-band verification, or policy boundary limiting agent authority. Addre ...[truncated 1439 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill trigger is extremely broad and claims authority over many financial and crypto-related tasks, increasing the chance the agent invokes it in situations involving sensitive funds, cards, or credentials without tight user intent matching. In a high-risk financial context, overbroad routing can cause unnecessary exposure to private keys, card data, and transaction workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly documents cards detail --reveal --json returning full PAN, CVV, expiry, and billing details for agent use, but does not require a prominent warning, explicit consent, or a just-in-time confirmation before exposing this highly sensitive payment data. This creates a direct path for unnecessary disclosure of full card credentials to an agent or logs, which could enable fraud or account compromise.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.
md
Always show a fee comparison (`payall cards fees`) so the user knows exactly what they'll pay. ## Display Guidelines When presenting card info to users, only show what they care about: card name, balance, status, card number, fees, etc. Skip internal fields like rank, id, binding_id, brand, rating, or general_ratings — these are technical identifiers that don't help the user.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill encourages use of payall auth login --key <private_key> and notes that the key is auto-saved for agents, but does not clearly warn users about the extreme sensitivity of private keys or the risks of passing them on the command line where they may leak via shell history, process listings, or agent logs. In a crypto wallet context, exposure of a private key can lead to total wallet compromise and irreversible fund theft.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill states that all CLI requests include source: "payall-cli" for backend analytics tracking, but this tracking is not surfaced as a clear warning to users in the main operational guidance. In a financial tool handling cards and wallets, undisclosed telemetry can undermine privacy expectations and create compliance concerns.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The skill normalizes non-interactive top-up flows using --yes to skip confirmation and labels them as suitable for agents. Even though the command itself returns only a deposit address, the surrounding workflow encourages autonomous movement of funds without a final human verification step, which is risky in financial operations.
Content: Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.
md
Non-interactive flags (use all three to skip all prompts): - `--amount <amount>` / `-a` — USDT amount - `--chain <chain>` / `-c` — Deposit network: `tron`, `bsc`, `eth` - `--yes` / `-y` — Skip confirmation The command returns a deposit address. Send USDT to that address and the card balance updates automatically after confirmation.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 95% confidence
Finding: The withdrawal flow supports --yes to skip confirmation while using a saved wallet key to authorize payouts from a card balance to crypto. In a financial context, removing confirmation from outbound value transfers materially increases the risk of mistaken or unauthorized withdrawals.
Content: Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.
md
- `--amount <amount>` / `-a` — USDT amount (must be > 2) - `--chain <chain>` / `-c` — Payout network: `tron`, `bsc`, `eth` - `--address <address>` — Destination wallet (defaults to user's own wallet) - `--yes` / `-y` — Skip confirmation - `--json` — JSON output (for agents) The command requires a saved wallet key (uses it to sign the withdrawal confirmation). Network fees: $1.50 for TRON, $1.00 for BSC/ETH.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 97% confidence
Finding: The wallet send command allows direct on-chain USDT transfers with --yes to skip confirmation, enabling fully autonomous asset movement. Because blockchain transfers are typically irreversible, an incorrect address, amount, or malicious invocation could immediately cause permanent loss of funds.
Content: Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.
md
- `--to <address>` — `0x...` (40 hex chars) for EVM, `T...` (34 chars, Base58) for TRON - `--amount <amount>` — USDT amount - `--chain <chain>` — `bsc`, `eth`, or `tron` - `-y, --yes` — Skip confirmation TRON transfers require TRX for energy/bandwidth fees. The CLI checks for non-zero TRX balance before sending and sets a 15 TRX fee limit. If a send fails, the CLI prints manual transfer instructions.

Static analysis

No suspicious patterns detected.