度小满支付技能

• Outcome: Review
• Latest audit: Jun 17, 2026 · 10:51 PM UTC
• Version: 1.0.11

Overview

This skill is mostly coherent as a payment and skill-install helper, but its installer can place remote ZIP contents into the local skills workspace without strong containment or verification.

Review before installing. Use this only if you trust the publisher and the clawpay.dxmjuhe.com distribution service, because it can install remote skill content into your local skills directory and stores a local signing key. Prefer running it in a contained environment, and avoid using the installSkill flow for untrusted skill IDs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill is presented as a payment QR helper, but the documented behavior also provisions local config, generates and stores keys, contacts remote services, downloads skills, and installs archive contents into local directories. This mismatch is security-relevant because it hides a much broader trust boundary and can cause operators or users to approve a skill without realizing it performs remote code/content acquisition and local installation.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The document explicitly claims the skill does not execute external commands, yet elsewhere instructs shell execution of Node.js scripts for QR generation and installation. This contradiction can mislead reviewers about the execution model and conceal command-execution capability, which increases the risk of unsafe approval and misuse.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The stated purpose emphasizes payment-link and QR handling, but the documented behavior extends to downloading and installing arbitrary skills on the local system. That broader capability materially changes the risk profile because it introduces remote content retrieval and filesystem modification under a much narrower-seeming description.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: A payment-wallet skill having authority to download and install other skills is an overbroad capability that can be abused to introduce unreviewed or malicious content into the local environment. In this context, the danger is elevated because installation writes remote-returned artifacts to disk and expands the blast radius beyond payment processing.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code downloads a remote ZIP and installs its contents directly into the local skills workspace with no trust verification, authenticity check of the archive payload, allowlist, or sandboxing. A compromised server, malicious publisher, or intercepted distribution channel could deliver arbitrary files that become installed as executable skill content, leading to code execution or persistent compromise of the agent environment.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The code comments and documented security design state that short-link generation is opt-in, but the executable path sets `enableShortUrl = true` by default and requires `--long-url` to disable it. This creates a security-relevant behavior mismatch: operators may believe no external network call occurs unless explicitly requested, while the script actually transmits validated payment URLs to the remote short-link endpoint by default, causing unintended data disclosure and weakening deployment assumptions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script persists the generated private key in plaintext JSON on disk without setting restrictive file permissions or warning the user. Any local user, backup system, or malware able to read that file can steal the key and impersonate the client for signed API requests, undermining identity and purchase/download authorization.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The CLI parsing and help text contradict the stated requirement that short-link creation be explicitly enabled, which can mislead users and integrators into unintentionally sending payment URLs to an external service. In a payment-related skill, this is more sensitive because outbound transmission of transaction URLs may expose business or user payment context and break privacy, compliance, or network-isolation expectations.

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.