Security audit
Security checks for vulnerabilities and agentic risk
The paid data lookups and document processing match the skill’s stated purpose, with disclosed charges and no hidden actions in the supplied artifact.
Use a dedicated wallet with limited funds and an approved spending budget. Check current prices, pin trusted CLI versions, and submit only document URLs you are comfortable sharing with 1gateway.
This recommends an unversioned npm CLI, not an MCP server as the scanner labels it. If the package is not already available locally, npx can obtain a mutable registry release; a compromised release could execute code with the agent's permissions, potentially exposing wallet credentials or other accessible secrets.
The setup command executes agentcash without pinning its version, allowing a fresh environment to resolve a changed registry release. A malicious release could run with the agent's privileges before or during origin configuration; the HTTPS destination does not protect against compromised local CLI code.
The optional discovery command still executes an unpinned npm package rather than merely reading remote documentation. If npx resolves a compromised release, that release can execute arbitrary code with the agent's permissions regardless of the command's apparently read-only purpose.
The apartment-trades example executes an unversioned agentcash CLI, creating a conditional supply-chain execution risk. Because this CLI performs paid requests, a compromised release could potentially access payment capabilities as well as other resources available to the agent.
The trades-summary command leaves the executable package version unspecified, so behavior can change when npx resolves a newer release. A compromised package would execute locally with the agent's privileges; the fixed API URL does not constrain that code.
Although the requested holiday data is low sensitivity, fetching it invokes an unpinned executable npm dependency. A compromised resolved release could access local files, credentials, or payment capabilities available to the process, making the risk independent of the data being queried.
The company-resolution example executes agentcash without an exact version, leaving fresh installations dependent on a mutable registry release. If that release is compromised, malicious code can run with the agent's permissions rather than being limited to the advertised company lookup.
The document-conversion example invokes an unpinned CLI, exposing the agent to malicious future package releases when npx resolves dependencies. This workflow may also handle sensitive document URLs, which compromised CLI code could capture alongside accessible credentials or payment capabilities.
The web-reading command uses an unversioned npm executable, so a fresh invocation can obtain code that was not reviewed with the skill. A compromised release could execute arbitrary local actions; specifying a fixed HTTPS API host does not mitigate this dependency risk.
The extraction example executes an unpinned agentcash package, allowing dependency changes outside the skill's review process. A malicious resolved release could run with the agent's privileges and potentially capture sensitive document URLs or access available wallet credentials.
The alternative payment command executes the unpinned awal npm CLI, not an MCP server. A compromised resolved release could execute with the agent's privileges, and the explicit wallet-payment context makes access to funds or payment credentials particularly consequential.
