Shieldz Payments

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:47 AM UTC
• Version: 0.1.1

Overview

The skill is mostly clear about creating Shieldz payment links, but it includes an optional local MCP command that downloads and runs an npm package while also claiming there is no dynamic code execution.

Review this skill before installing. The REST flow is disclosed and user-confirmed, but avoid the optional local `npx -y @shieldz/mcp@0.3.0` path unless you trust that package and can run it in a restricted environment. Treat manage URLs and manage tokens like passwords, and only send wallet, memo, amount, or email details to Shieldz when you intend to use that service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:103

Finding

Automatic Download and Execution of an Unverified npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 103-108
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

markdown

## Optional: MCP instead of REST

If the agent uses MCP, the same three actions are available keyless via the
Shieldz MCP server: remote at `https://shieldz.cash/mcp`, or local with a
**pinned** version `npx -y @shieldz/mcp@0.3.0`. Tools: `create_payment_link`,
`create_tip_jar`, `get_account_status`.

Technical Analysis

The local MCP option instructs the agent to execute npx -y @shieldz/mcp@0.3.0. The -y option suppresses interactive confirmation, while npx may retrieve the package from the configured npm registry and immediately execute package code.

Pinning the version reduces exposure to unreviewed future releases but does not establish package integrity or prove that version 0.3.0 is safe. The instruction does not require a verified lockfile, package integrity hash, vendored and reviewed source, disabled lifecycle scripts, or sandboxing. Package installation or execution can therefore run code with the privileges and environmental access of the agent process.

This behavior also conflicts with the safety statement later in the file claiming that the skill performs no dynamic code execution. The REST and remote MCP alternatives do not require this local npm execution path, so the vulnerable behavior is limited to users or agents selecting the optional local MCP mode.

Attack Path

1. A user or agent selects the documented local MCP option.
2. The agent runs npx -y @shieldz/mcp@0.3.0.
3. npx obtains the package and its dependency graph from the configured npm registry or cache without requesting interactive approval.
4. npm lifecycle scripts, package entry points, or transitive dependency code execute locally.
5. If the package, one of its dependencies, the registry response, or the local npm configuration has been c ...[truncated 1036 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer the documented REST API, which avoids downloading and executing an npm package locally.
2. If local MCP support is required, vendor and manually audit the exact package source and its complete transitive dependency graph.
3. Install dependencies through a committed lockfile containing registry integrity hashes rather than invoking npx directly at runtime.
4. Use a trusted private registry or other controlled artifact source, and verify package provenance or signatures where supported.
5. Disable npm lifecycle scripts during installation where compatible, then explicitly run only reviewed entry points.
6. Execute the MCP process in a restricted sandbox or container with minimal filesystem access, no unnecessary environment variables, a read-only working directory, and tightly controlled network egress.
7. Remove the automatic-confirmation option (-y) so package retrieval and execution cannot occur silently.
8. Update the safety summary to disclose that the optional local MCP path downloads and executes third-party code, rather than claiming that no dynamic code execution occurs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

- an **email address**, only if the user explicitly provides one (see below)
- when reading status, the **manage_token**

Treat every `manage_url` / `manage_token` as a **private access credential**:
anyone holding it can read the account's totals and settings. Do not post them
publicly, paste them into shared contexts, or write them to logs.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

Keyless, no Authorization header. Only call this after the confirmation above.

bash

curl https://shieldz.cash/api/v1/links \
  -H "Content-Type: application/json" \
  -d '{
    "settlement": { "chain": "BASE", "asset": "USDC", "address": "0xUserProvidedWallet" },

Static analysis

No suspicious patterns detected.