Security audit

Sardis — Payment OS for AI Agents

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent payment skill, but its executable server has unsafe controls that could expose API credentials or allow payments without confirmed policy approval.

Review before installing in any live environment. Use only with sandbox or low-limit credentials until the server rejects caller-supplied API origins, retrieves credentials from trusted server-side configuration, authenticates execute requests, and makes payment policy checks fail closed. Treat all examples as capable of moving real funds or exposing sensitive card/payment data.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: src/sardis_openclaw/server.py:109
Finding: Caller-Controlled API Base URL Enables Credential Disclosure and SSRF
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/sardis_openclaw/skills/payment.py:39
Finding: Payment Policy Validation Fails Open and Allows Transfers After Policy-Check Errors
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (201)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The code chunk is a skill-definition/registry module for an agent payment toolkit, and several declared capabilities are represented: wallet creation, balance checks, stablecoin payments, and natural-language policy updates. However, the declared description also claims virtual card issuance, which is not present anywhere in the listed skills or registry. Additionally, the code exposes several material capabilities not mentioned in the description: transaction compliance preflight, invoice creation, cross-chain bridging via CCTP, and spending analytics reports. These are not merely implementation details; they are separate user-facing functions. Therefore the declared description does not accurately represent the actual behavior shown in the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: The declared description broadly matches a payment/wallet management system, and several listed capabilities are reflected in the code: wallet creation, balance checking, payments, and policy updates. However, the code also exposes additional capabilities not mentioned in the description, including compliance checks, invoice creation, bridge transfers, and spending reports. Conversely, the description claims virtual card issuance, but no corresponding skill is present in this code chunk. These are material enough to count as a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a general payment platform focused on wallet creation, payments, spending controls, balance checks, and virtual cards. The supplied code instead implements a specific cross-chain bridge transfer operation via CCTP. Bridging is a materially different primary capability from the listed functions and is not explicitly represented in the declared purpose or triggers. Additionally, the code chunk does not implement the broader advertised functions. This is therefore a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a comprehensive payment platform with multiple financial operations, but the supplied code only performs one narrow function: a compliance preflight API call. This is a materially different primary purpose from the broad payment OS description. The code does not create wallets, send payments, enforce or configure spending rules, check balances, or issue cards. While compliance checks could be related to payment workflows, this specific capability is not what the description emphasizes, and the described triggers do not clearly map to a standalone compliance-check skill. Therefore, the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a payment operating system focused on wallet creation, outbound payments, policy enforcement, spending controls, balance checks, and virtual cards. The supplied code instead implements a distinct invoice-creation skill for receiving funds. Invoice creation is a payment-related capability, but it is not represented in the declared purpose, making the code's primary function materially different from the stated functionality. The code's API access and required permission (invoice:create) are also aligned with invoice issuance rather than the declared feature set.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code chunk is narrowly focused on sending a payment with policy enforcement, which is only one subset of the declared description. It does not create wallets, check balances, define spending rules, or issue virtual cards. There are no obvious undeclared harmful capabilities beyond payment execution and policy checking, but the declared purpose materially overstates what this specific code does. Therefore this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The supplied code chunk has a materially different primary purpose from the declared description. Rather than acting as a broad payment OS capability, it only retrieves spending analytics for an agent over a time period. Its parameters, permission (analytics:read), and API endpoint (/analytics/spending) all indicate read-only reporting behavior. This is not a supporting implementation detail of the declared functions like payments, wallet creation, balance checks, spending policy management, or card issuance; it is a separate analytics capability with different triggers and resource access.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The provided manifest context says the skill should be a payment OS for AI agents, covering MPC wallets, stablecoin payments, spending rules, balance checks, and virtual cards. This file instead describes registering agent identities, TAP verification, and reputation tracking, which is a materially different capability set rather than an implementation detail of payments.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · src/sardis_openclaw/skills/policy.py (reported line 1)May include surrounding context.
python
"""Policy update skill.""" from __future__ import annotations from typing import Any

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README presents wallet creation, payments, and virtual card issuance as normal agent actions without an explicit warning that these operations can move real funds or create account-impacting resources. In an agent-skill context, this increases the chance that an integrator or downstream agent treats these as routine automation instead of high-risk financial actions requiring explicit user consent and safeguards.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 28)May include surrounding context.
md
--- ### [sardis-balance](./skills/sardis-balance/SKILL.md) - Read-Only Balance & Analytics Safe, read-only skill for monitoring wallet balances and spending patterns.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 36)May include surrounding context.
md
--- ### [sardis-policy](./skills/sardis-policy/SKILL.md) - Spending Policy Management Create and manage spending policies using natural language or structured rules.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 44)May include surrounding context.
md
--- ### [sardis-cards](./skills/sardis-cards/SKILL.md) - Virtual Card Management Issue virtual cards for AI agents to make real-world purchases.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 52)May include surrounding context.
md
--- ### [sardis-guardrails](./skills/sardis-guardrails/SKILL.md) - Security Controls Circuit breakers, kill switches, and behavioral anomaly detection.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 60)May include surrounding context.
md
--- ### [sardis-identity](./skills/sardis-identity/SKILL.md) - Agent Identity TAP-verified agent identities with reputation tracking.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 68)May include surrounding context.
md
--- ### [sardis-escrow](./skills/sardis-escrow/SKILL.md) - Smart Contract Escrow Milestone-based escrow for agent-to-agent payments.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 76)May include surrounding context.
md
--- ### [sardis-tempo-pay](./skills/sardis-tempo-pay/SKILL.md) - MPP Payments on Tempo Machine Payments Protocol sessions with Sardis spending mandates on Tempo mainnet.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The quick-start section includes live examples for creating agents, applying policies, and executing payments against production endpoints, but it does not warn that these commands may have immediate financial or account consequences. Copy-pasteable production payment examples materially raise the risk of accidental fund movement or policy changes by operators and autonomous agents.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 109)May include surrounding context.
bash
# Create agent (auto-provisions wallet) curl -X POST https://api.sardis.sh/api/v2/agents \ -H "X-API-Key: $SARDIS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"name": "my-agent", "description": "Payment agent"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Although external transmission to the payment API is expected, this specific example is a live payment call to a production endpoint with no visible warning, dry-run, or confirmation guidance. In the context of an agent skill for autonomous payments, normalizing direct payment execution increases the chance of accidental or unauthorized fund transfers.
Content: Scanner excerpt · README.md (reported line 125)May include surrounding context.
md
-d '{"agent_id": "agt_123", "natural_language": "Max $500/day, only OpenAI"}' # Execute payment (policy auto-enforced) curl -X POST https://api.sardis.sh/api/v2/pay \ -H "X-API-Key: $SARDIS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"to": "openai.com", "amount": "25.00", "currency": "USDC", "chain": "base"}'

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · README.md (reported line 186)May include surrounding context.
md
All skills enforce these security principles: 1. **Policy-First**: Always check spending policy before payment 2. **Never Bypass**: No approval flow bypassing 3. **Fail Closed**: Deny by default on policy violations 4. **Audit Everything**: Complete transaction logging 5. **Read-Only When Possible**: Use `sardis-balance` for monitoring

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares no explicit tool scope or permission boundaries even though it clearly requires environment-secret access and network egress to a payment API. In a payment-moving skill, missing least-privilege declarations increases the chance that an agent can invoke sensitive capabilities without adequate runtime restriction or user review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description advertises payment execution and virtual card issuance without prominently warning that these actions can move real funds and may expose highly sensitive payment card data. In an agent setting, insufficient warning can lead to unsafe invocation, accidental spending, or disclosure of PAN/CVV/expiry data into logs, model context, or chat transcripts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger language is broad enough that the skill may activate on generic payment-related prompts, causing a fund-moving or card-issuing capability to engage in contexts where the user did not intend real financial actions. In a payments skill, overbroad triggering materially increases the chance of accidental wallet creation, balance disclosure, policy changes, or real-money transfers.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: The skill is explicitly designed to transmit secrets and transaction data to an external payment service over the network. External transmission is expected here, but in the context of API keys, wallet identifiers, balances, merchant details, and card issuance, it is security-relevant and dangerous if not tightly scoped and disclosed.
Content: Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.
md
env: - SARDIS_API_KEY bins: - curl primaryEnv: SARDIS_API_KEY emoji: "\U0001F4B3" homepage: https://sardis.sh

Static analysis

No suspicious patterns detected.