Security audit
z-zero-payments
Security checks for vulnerabilities and agentic risk
Overview
This payment skill is high impact, but its instructions are coherent, explicit about approval requirements, and proportionate to its stated purpose.
Install only if you intend to let the agent assist with real purchases. Keep the API key protected, review the MCP server/package source you are trusting, and require the agent to show the final total and wait for explicit approval before any checkout.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.