ClawHub
Back to skill

Security audit

z-zero-payments

Security checks for vulnerabilities and agentic risk

Overview

This payment skill is mostly transparent about what it does, but it asks users to run mutable external payment code with a financial credential and to follow a mutable external payment procedure.

Review this carefully before installing. Use only in an isolated agent environment, prefer a pinned and reviewed MCP server version instead of @latest, keep spending limits low, require human approval for every payment, and avoid sharing the same OS user or credential store with unrelated agents.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Error
Location
SKILL.md:45
Finding

Unpinned npm Package Is Downloaded and Executed with a Financial Credential

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:56
Finding

Payment Workflow Delegates Authoritative Instructions to a Mutable External SOP

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:33
Finding

Machine-Wide Sharing of a Persisted Financial Credential Violates Per-Agent Least Privilege

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md
7. Relay the result status and the receipt: `signed_receipt.diff` shows what the merchant actually did versus what was authorized (charged more, swapped an item). `verify_receipt(receipt_id)` re-checks it any time.
8. If a checkout failed for a *technical* reason, call `report_checkout_fail(url, failure_class, step, error_message)`. `failure_class` is a fixed enum — `card_declined_issuer`, `card_declined_bin_block`, `avs_mismatch`, `3ds_required`, `bot_detected`, `form_changed`, `price_changed`, `out_of_stock`, `shipping_unsupported`, `login_required`, `timeout`, `outcome_unconfirmed`, `intent_mismatch`, `unknown` — so each failure becomes evidence the next agent can use, not a log line.

## Wallet operations (read-only, no approval needed)

- `list_cards` — card aliases and balances
- `check_balance` — spendable USD for an alias