Agent Payment Policy

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:04 AM UTC
• Version: 0.15.0

Overview

This skill is a coherent payment-output validation guide, with a disclosed npm CLI dependency users should run carefully.

Before installing, treat the npm CLI as third-party code. Prefer a locked install with integrity metadata, run the local installed binary or npx with no-install behavior, and avoid running it in an environment containing wallet secrets, signing keys, or unrelated credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:77

Finding

Unverified Third-Party npm Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 77–80
Vulnerability Type: Supply-chain exposure through an externally sourced npm dependency
Risk Level: Medium

Vulnerable Code

bash

npm install --save-exact agent-payment-policy@0.15.0
npx agent-payment-policy output-schema-check \
  ./output-schema.json \
  data.source,data.value,data.observedAt

Technical Analysis

The skill directs the user or agent to retrieve agent-payment-policy@0.15.0 from the configured npm registry and then execute its CLI through npx. An exact version prevents ordinary version drift, but it does not authenticate the retrieved package contents or make the dependency implementation reviewable from this project.

The project does not include the package source, a lockfile with integrity metadata, or another content digest for independently verifying the downloaded artifact. Package installation can also execute npm lifecycle scripts unless they are explicitly disabled. Consequently, trust is delegated to the registry, account controlling the package, configured registry infrastructure, and transitive dependency chain.

This is a supply-chain weakness rather than evidence that the named package is currently malicious.

Attack Path

1. An attacker compromises the package publisher, npm account, configured registry, registry infrastructure, or a transitive dependency.
2. Malicious content is made available under the referenced package version or supplied through the package’s dependency chain.
3. A user or agent follows the documented npm install instruction.
4. Malicious lifecycle code may run during installation with the invoking user’s privileges.
5. The subsequent npx agent-payment-policy command executes package-controlled code.
6. That code can access resources available to the process, such as local files, environment variables, working-directory content, and network connectivity.

Impact Assessment

Successful exploitation provide ...[truncated 689 chars]

Remediation

View remediation

Remediation Suggestions

1. Vendor and audit the required implementation so the executed code is included in the reviewed project.
2. Commit a lockfile containing registry resolution and integrity metadata, and use a reproducible installation command such as npm ci.
3. Disable lifecycle scripts during installation where they are unnecessary:

bash

npm ci --ignore-scripts

4. Execute a reviewed local binary from the locked installation rather than relying on dynamic npx resolution.
5. Verify package provenance, signatures, and integrity through the organization’s trusted package-management controls.
6. Route dependencies through an approved registry mirror with malware scanning and package allowlisting.
7. Run the CLI in a least-privileged sandbox without wallet secrets, signing keys, unrelated credentials, or unnecessary filesystem and network access.
8. Audit direct and transitive dependencies before approving package upgrades.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs users to run npx agent-payment-policy, which can execute a package resolved at runtime from the registry rather than a locally pinned binary. Even though the preceding npm install --save-exact agent-payment-policy@0.15.0 reduces risk, the command as written does not explicitly invoke the pinned local binary and may execute unexpected code if package resolution or environment behavior is altered.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.