nano-pay

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:42 AM UTC
• Version: 1.1.0

Overview

This skill is clearly for Nano micropayments, but it asks agents to install unpinned payment software and operate persistent wallets that can move real funds.

Review this carefully before installing. Use a dedicated low-balance wallet, isolate the environment, avoid exposing unrelated environment variables, verify the `feeless402` package/version yourself, and require explicit approval before `pay`, `send`, `topup --execute`, or `serve` actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned and Unauditable Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9–10
Vulnerability Type: Unpinned third-party dependency and supply-chain exposure
Risk Level: Medium

yaml

install:
  - "pip install feeless402"

Technical Analysis

The skill instructs the environment to install feeless402 from PyPI without specifying an exact version or verifying an integrity hash. Consequently, installation resolves to whichever package release the repository serves at that time. The installed package provides the nano-pay executable and is expected to process wallet seeds, cryptocurrency payments, swap API credentials, network requests, and merchant-server operations.

The project contains only SKILL.md; the dependency's source code is not included. Its implementation and claimed protections therefore could not be reviewed as part of this audit. An unreviewed future release, compromised maintainer account, or compromised package-distribution path could introduce arbitrary executable code after this skill has already been approved.

Attack Path

1. An attacker compromises the feeless402 package, its maintainer account, or a future package release.
2. The attacker publishes a modified release containing malicious installation-time or runtime code.
3. A user or agent follows the skill metadata and runs pip install feeless402.
4. Because no version or hash is enforced, the package manager retrieves the attacker-controlled release.
5. The malicious code executes with the privileges of the account performing installation or invoking nano-pay.
6. It can access data available to that account, potentially including Nano wallet files, environment variables such as NANSWAP_API_KEY, payment data, and other readable local files.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's privileges. The accessible scope may include:

• Theft of wallet seeds and c ...[truncated 676 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an explicitly reviewed version, for example:

   yaml

   install:
     - "pip install feeless402==<reviewed-version>"
   

2. Use a hash-locked requirements file and require hash verification during installation:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Record the expected package artifact hash and verify it through CI before publishing the skill.
4. Include the dependency's reviewed source code in the audited repository, or reference an immutable source commit and provide reproducible build instructions.
5. Install and execute the package in an isolated virtual environment or container under a dedicated, unprivileged account.
6. Restrict filesystem and environment-variable access so the process can reach only the wallet and credentials required for the current operation.
7. Keep minimal working capital in the wallet and avoid exposing unrelated credentials to the process.
8. Review every dependency update before changing the pinned version, including transitive dependencies and installation hooks.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description says to use the skill 'when you need pay-per-call access to a paid endpoint, to compare payer cost across payment rails, or to send/receive/top-up Nano,' which is a wide set of natural-language conditions without clear boundaries or exclusions. In a manifest file, this can make activation overly broad because it does not clearly distinguish when the skill should not be invoked.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill instructs the agent to create and persist a self-custodied wallet locally, introducing durable financial state across sessions. Session persistence is risky here because later invocations could spend retained funds or expose wallet metadata if the agent or environment is compromised; the skill context increases danger because persisted state directly controls money and the workflow encourages autonomous claiming, topping up, and paying.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

with a real settled payment — no card, no KYC, no human:

bash

nano-pay init                                   # create your wallet
nano-pay quote https://feeless402.com/premium?ref=skill   # see the 402 — note the railHint "why" explaining feeless vs USDC gas floors
nano-pay claim https://feeless402.com/faucet?ref=skill    # free starter XNO (solves a PoW, ~1 min, one claim per address)
nano-pay pay https://feeless402.com/premium?ref=skill     # pay it — settles feeless, sub-second, $0.00 gas

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

All commands print JSON. Binary: nano-pay (or python -m nano_pay.cli).

bash

nano-pay init                 # create wallet (~/.nano-pay/wallet.json, chmod 600)
nano-pay address              # show your nano_… address
nano-pay status               # balance + pending incoming
nano-pay receive              # pocket all pending incoming XNO