T09 · Insecure Skill Coding Practices
Error
- Location
scripts/gstable-ai-payment.py:541- Finding
Remote API Data Controls Arbitrary Transactions and Unlimited Token Approvals
- Content
View full analysis
- Remediation
View remediation
Security audit
gstable-ai-payment
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed crypto payment tool, but it should be reviewed carefully because it can sign live transactions and grant broad token approvals automatically.
Install only if you are comfortable giving this skill control of a wallet private key. Use a dedicated low-balance wallet, avoid the one-command pay path until you have reviewed the payment details, verify the chain, token, recipient, spender, and amount before every approval or transaction, and do not set GSTABLE_API_BASE_URL or RPC URLs to endpoints you do not fully trust.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/api.py:11- Finding
Security-Sensitive Payment API Endpoint Can Be Redirected to an Arbitrary Origin
- Content
View full analysis
str: """Get API base URL from environment or use default""" return os.environ.get("GSTABLE_API_BASE_URL", "https://aipay.gstable.io/api/v1") ``` ```python url = f"{_get_api_base_url()}{endpoint}" ``` ```python return Config( wallet_private_key=wallet_private_key, api_base_url=os.environ.get("GSTABLE_API_BASE_URL", "https://aipay.gstable.io/api/v1"), default_payer_email=os.environ.get("DEFAULT_PAYER_EMAIL", "ai-agent@example.com"), rpc_urls=rpc_urls, ) ``` ### Technical Analysis `GSTABLE_API_BASE_URL` accepts an arbitrary URL without enforcing HTTPS, validating the hostname, or requiring explicit confirmation for a non-production service. The remote endpoint receives wallet and payment metadata, payer email addresses, EIP-712 messages, and signatures. More critically, the endpoint returns `executorContract`, `executionChainId`, and `calldata`, which are consumed by the transaction workflow. As a result, environment-variable manipulation changes a security-critical trust boundary rather than merely changing a passive data source. The `Config.api_base_url` value is also loaded but the API module independently rereads the environment variable. This duplicate configuration path makes centralized validation harder and may lead developers to believe validation in `Config` would protect API requests when it would not. ### Attack Path 1. An attacker gains influence over the process environment, deployment configuration, wrapper script, CI configuration, or agent runtime configuration. 2. The attacker sets `GSTABLE_API_BASE_URL` to an attacker-controlled endpoint. 3. The skill sends payment metadata and signed authorization messages to that endpoint. 4. The m ...[truncated 828 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
pyproject.toml:8- Finding
Security-Critical Dependencies Are Not Reproducibly Pinned
- Content
View full analysis
=0.13.0", "httpx>=0.27.0", ] ``` ### Technical Analysis The project uses open-ended minimum-version constraints for both signing and networking dependencies, and the audited project does not include a lockfile. Consequently, `uv sync` can resolve future package releases that were not reviewed with the skill. `eth-account` operates directly on the wallet private key and signs both EIP-712 messages and blockchain transactions. `httpx` handles communication with payment APIs and RPC services. A malicious, compromised, or unexpectedly incompatible future release would execute inside the same process and inherit access to these sensitive values and operations. No evidence was found that either dependency is currently malicious. The issue is the absence of a reproducible and reviewed dependency set. ### Attack Path 1. A future dependency or transitive dependency release satisfies the open-ended version constraint. 2. The release is compromised, malicious, or contains a security regression. 3. A user runs the documented `uv sync` installation command without a committed lockfile. 4. The resolver installs the affected release. 5. The dependency executes in the payment process and can access private-key operations, signed transactions, API data, and network communications. ### Impact Assessment A compromised signing dependency could access or misuse the wallet private key and authorize arbitrary transactions. A compromised networking dependency could intercept or alter payment and RPC traffic. The practical likelihood is lower than the transaction-validation findings because exploitation depends on a malicious or vulnerable dependency release, but the potential impact includes complete compromise of the configured wallet. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (15)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The execute command signs and broadcasts an arbitrary transaction to any provided destination address with arbitrary calldata, using the configured wallet private key. That capability exceeds the stated payment-specific purpose and allows any caller or integrating agent to repurpose the skill as a general blockchain transaction signer, which could transfer assets, approve spenders, or invoke malicious contracts if untrusted inputs are passed through.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The execute path submits a live on-chain transaction immediately after building and signing it, with no explicit consent checkpoint, transaction summary, or warning that real funds or approvals may be affected. In agentic contexts, this is especially dangerous because upstream prompts, tool-use decisions, or compromised services could cause irreversible blockchain actions without meaningful user awareness.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The approve command defaults to MAX_UINT256 when no amount is supplied, creating an infinite ERC20 allowance without an explicit warning or confirmation. Infinite approvals are a well-known high-risk pattern because if the approved spender is malicious, compromised, or later upgraded, the wallet's token balance can be drained long after the initial approval.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The pay command chains discovery, session creation, payment preparation, optional token approval, and final transaction submission into one automatic flow with no explicit consent checkpoint between steps. Because it can both create broad token allowances and broadcast a transaction based on externally sourced link/session data, this design amplifies the blast radius of any malicious payment link, compromised backend response, or agent mistake.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill requests and uses a highly sensitive environment variable (WALLET_PRIVATE_KEY) and performs networked blockchain operations, but it does not declare an explicit tool scope or permissions boundary. In an agent setting, this increases the chance that the skill is invoked with broader-than-necessary capabilities, enabling unintended fund-moving actions or secret exposure through loosely governed execution.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Features - 🔗 Retrieve payment link details and supported tokens - 📝 Create payment sessions (EIP-712 signatures) - 🔍 Query payment session status - 💰 Check native and ERC20 balances - 💳 Prepare payments and generate on-chain transaction calldata
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The feature list advertises automatic token approval and on-chain execution without prominently warning that approvals can authorize token spending and that blockchain transactions are generally irreversible. In an autonomous-agent context, this can normalize dangerous fund movement behavior and cause users or orchestrators to trigger spending without fully understanding the consequences.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The quick-start examples encourage immediate use of the one-command pay flow, which can create sessions, approve tokens, and submit live on-chain transactions without an explicit warning at the point of use. This is especially risky for agent-driven workflows because a copied example may trigger real asset transfers with minimal operator review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This function sends a signed EIP-712 message and signature to an external payment service, but the client code provides no user-facing disclosure, consent checkpoint, or trust boundary documentation before transmitting sensitive authorization material. In a payment skill, signatures can authorize financial actions or reveal reusable payment metadata, so silently forwarding them to a remote API materially increases the risk of unintended payment authorization or misuse if the service, configuration, or surrounding workflow is compromised.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This payment preparation call transmits signed payload data to an external service to obtain calldata, again without any visible disclosure or consent mechanism in the client. Because this skill's purpose is cryptocurrency payments, signed messages are especially sensitive: sending them to a third party can expose authorization artifacts and enable harmful downstream transaction preparation if users are unaware or if the endpoint is altered.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The manifest describes discovering, negotiating, and executing cryptocurrency payments, which does justify payment-related network and transaction logic. However, directly ingesting a raw private key from environment variables is a distinct sensitive capability involving custody of signing credentials, and that custody expectation is not stated in the manifest text.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The approve command exposes a generic ERC20 approval primitive that can approve any spender for any token, independent of a validated payment session. In a payment skill, this broad authority lets the skill grant spending rights to arbitrary contracts, and because approvals often persist, a malicious or mistaken spender could later drain tokens from the wallet up to the approved amount.
- Content
Unverifiable Dependency: eth-account has 2 known advisory(ies) (CVE-2022-1930 (Regular expression denial of service in eth-account); CVE-2022-1930 (Regular expression denial of service in eth-account)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unverifiable Dependency: httpx has 2 known advisory(ies) (CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Static analysis
No suspicious patterns detected.