T09 · Insecure Skill Coding Practices
Error
- Location
resources/crypto-wallets.ts:122- Finding
Incorrect BNB Chain Token Decimals Permit Near-Zero Underpayments
- Content
View full analysis
- Remediation
View remediation
Security audit
Self-hosted Crypto Payment
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent crypto-payment skill, not apparent malware, but it needs review because its payment-confirmation code and install guidance can create real financial and credential risk.
Review and fix the payment verifier before production use. Pin the skill and installer source, generate the wallet mnemonic offline, store secrets only in a trusted secret manager, avoid giving CRON_SECRET to third-party schedulers, validate token decimals per chain, and make payment fulfillment transactionally idempotent.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
resources/check-crypto-payments-route.ts:206- Finding
Non-Atomic Payment Claim Allows Duplicate Fulfillment
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:102- Finding
External Scheduler Guidance Exposes a Privileged Cron Bearer Secret to a Third Party
- Content
View full analysis
Fly.io machines / self-hosted: Use a scheduled task or external cron (e.g. cron-job.org) hitting the endpoint with Authorization: Bearer . ``` ### Technical Analysis The Skill recommends an external cron provider as an operational option. Following that guidance requires storing the application's `CRON_SECRET` with the third-party provider. The secret authorizes an endpoint that uses a Supabase service client to enumerate all pending payments, query blockchain providers, change payment states, and run account-fulfillment logic. It is therefore a privileged operational credential rather than a harmless scheduling token. The external provider may legitimately receive the credential if the operator deliberately selects that architecture, but this exceeds the minimum trust boundary needed for a self-hosted payment system and conflicts with the product's strong “zero third-party dependency” framing. ### Attack Path 1. An operator follows the documented external-cron setup. 2. The operator stores the bearer credential in the third-party scheduler. 3. The scheduler account, provider infrastructure, logs, or configuration is compromised. 4. An attacker obtains the bearer token. 5. The attacker invokes the cron endpoint repeatedly or concurrently. 6. The endpoint runs privileged payment-processing operations using the service client. 7. Concurrent invocations may additionally trigger the duplicate-fulfillment race condition. ### Impact Assessment Possession of the credential permits unauthorized invocation of the privileged payment-checking workflow. It does not directly expose the master mnemonic or grant arbitrary database queri ...[truncated 281 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:22- Finding
Unpinned npx Installation Command Creates a Mutable Supply-Chain Execution Path
- Content
View full analysis
- Remediation
View remediation
add ... ``` 2. Pin the Skill to an immutable commit hash or signed release rather than a mutable repository name. 3. Publish checksums or signatures for released Skill artifacts. 4. Instruct users to inspect downloaded files before enabling the Skill. 5. Use lockfiles and trusted registries for all npm dependencies. 6. Document the exact source revision corresponding to each release and audit. 7. Avoid installation modes that automatically execute lifecycle scripts unless those scripts have been reviewed. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:78- Finding
Web-Based Master Mnemonic Generation Guidance Introduces an Avoidable Secret-Exposure Boundary
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `crypto-checkout-route.ts` | `src/app/api/billing/crypto-checkout/route.ts` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `crypto-checkout-route.ts` | `src/app/api/billing/crypto-checkout/route.ts` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `crypto-checkout-route.ts` | `src/app/api/billing/crypto-checkout/route.ts` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `crypto-checkout-route.ts` | `src/app/api/billing/crypto-checkout/route.ts` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `crypto-checkout-route.ts` | `src/app/api/billing/crypto-checkout/route.ts` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `crypto-payment-modal.tsx` | `src/components/dashboard/crypto-payment-modal.tsx` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `crypto-payment-modal.tsx` | `src/components/dashboard/crypto-payment-modal.tsx` |
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The Bitcoin checker uses funded_txo_sum, which is the cumulative amount ever received by the address and does not decrease when coins are later spent. An attacker can send funds to the address, move them away, and future checks may still treat the payment as satisfied, causing false confirmations and crediting unpaid orders.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The README instructs users to run
npx skills add Flacko2048/self-hosted-crypto-paymentswithout pinning a specific version, commit, or digest of the installer/source. That allows a future upstream change, account compromise, or package substitution to alter what gets fetched and executed at install time, creating a supply-chain risk rather than a direct flaw in the crypto logic itself.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Confirmation is based solely on whether the current address balance meets a threshold, not whether a specific payment transfer for this invoice occurred. If addresses are ever reused, or if unrelated funds already exist at the address, a pending payment can be marked confirmed without the payer actually sending the required funds for that order.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
ts if (!geckoId) throw new Error(`No CoinGecko ID for coin: ${coin}`) const res = await fetch( `https://api.coingecko.com/api/v3/simple/price?ids=${geckoId}&vs_currencies=usd`, { cache: 'no-store', signal: AbortSignal.timeout(6000) } ) if (!res.ok) throw new Error(`CoinGecko API failed: ${res.status}`)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
ts arbitrum: { rpc: 'https://arb1.arbitrum.io/rpc', chainId: 42161 }, optimism: { rpc: 'https://mainnet.optimism.io', chainId: 10 }, bnb: { rpc: 'https://bsc-dataseed.binance.org', chainId: 56 }, avalanche: { rpc: 'https://api.avax.network/ext/bc/C/rpc', chainId: 43114 }, } // ERC-20 token contract addresses per network
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This code accesses a highly sensitive credential source,
CRYPTO_MASTER_MNEMONIC, to derive wallet addresses. Although comments state the mnemonic is server-only, there is no confirmation prompt, user-facing log, or other disclosure mechanism warning that a master wallet secret is being used.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This code reads a secret from
process.env.CRON_SECRETto authorize access, which is a sensitive credential-handling operation. Although the logic is implemented safely, the file provides no docstring or comment disclosing that the route depends on a secret-bearing Authorization header, which matches the code-file warning criterion for sensitive environment variable access lacking disclosure.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The balance-check helpers transmit wallet addresses to external providers such as EVM RPC endpoints, the Bitcoin API, and Solana RPC. These are network operations involving user/payment data, but the file contains no user-facing warning, disclosure comment, or docstring explaining that payment addresses will be queried against third-party services.
- Content
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- resources/check-crypto-payments-route.ts:20