Voidly Pay

• Outcome: Pass
• Latest audit: May 28, 2026 at 1:51 PM UTC
• Version:
  1.0.0

Overview

This is a disclosed agent-payment and marketplace skill, but users should understand it can send task data to external services and spend Voidly credits.

Install only if you are comfortable enabling Voidly's external payment and marketplace infrastructure. Use explicit approvals, provider allowlists, and spending limits before any registration, faucet claim, hiring, payment, or MCP tool action, and avoid sending confidential prompts or business data unless you trust the provider path.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The invocation guidance is overly broad and could cause an agent platform to activate this payment/marketplace skill for ordinary requests about AI services, coordination, trust checks, or micropayments. In a skill that can register identities, contact external APIs, and initiate economic actions, ambiguous triggers increase the risk of unintended external actions or data sharing without sufficiently explicit user intent.

VirusTotal

6/63 vendors flagged this skill as malicious, and 57/63 flagged it as clean.