Security audit
Security checks for vulnerabilities and agentic risk
This is a real payment skill whose core behavior is disclosed, but it gives an agent broad money-moving authority with weak confirmation controls and some misleading credential-storage documentation.
Install only if you are comfortable letting this skill store payment credentials locally and initiate payments through an agent. Before use, confirm the payment limit in the wallet app, require the agent to show merchant, amount, order details, and seqId before every payment, and avoid allowing automatic support emails or profile-file reads without reviewing what will be sent or read.
The documented L99999 '卸载技能' capability exceeds the declared payment-related scope and enables destructive local state cleanup unrelated to core payment operations. In an agent setting, exposing an uninstall primitive broadens the attack surface and can be abused to delete local credentials or disrupt the skill without clear user expectation.
The uninstall response returns local environment details such as skillDir and nodeModulesDir, which are unnecessary for payment use cases and disclose filesystem layout. Such path disclosure can assist follow-on attacks, reconnaissance, or targeted abuse of the host environment, especially when combined with a local destructive action.
The guide states that the skill/AI will automatically obtain subWalletName from OpenClaw user.md, which introduces access to agent identity/profile data that is not strictly required for core payment credential storage. In a payment context, expanding data access beyond the minimum necessary increases the blast radius of compromise and can create unintended cross-file data exposure or privacy leakage if user.md contains additional sensitive metadata.
The troubleshooting guide introduces a workflow to send issue details to an external email address, which is outside the declared payment/query scope of the skill. Even though it includes a sensitive-data filter, it still expands the skill's behavior into outbound data sharing and can expose operational or user-context data if the filter is incomplete or bypassed.
The documentation states that apiKey and subWalletId are automatically read from local state and used for other interfaces, but it does not emphasize consent boundaries or user-facing confirmation before using stored financial credentials. In a payment skill, implicit credential reuse is risky because an agent may trigger sensitive operations with less visibility than the user expects.
The skill exposes payment initiation through broad natural-language triggers such as '我要支付', '帮我付款', and '确认买单', which are common conversational phrases and can be matched outside a clearly authenticated checkout context. In a payment skill, ambiguous activation materially increases the risk of unintended or socially engineered payment execution, especially because this capability causes financial loss rather than a harmless action.
The payment initiation section again defines fuzzy, everyday trigger phrases for a money-moving operation and states that the agent may 'directly execute' once it detects a payment intent. In the context of a financial skill with passwordless payment support, weak trigger boundaries substantially raise the chance of accidental activation, prompt-injection from merchant content, or coerced confirmation flows that lead to unauthorized charges.
The document instructs collecting conversation-derived issue information and sending it to rd@zlrt.net, including language suggesting 'I already sent it for you,' without requiring explicit informed consent before transmission. In a payment skill, this is particularly risky because surrounding context may contain transaction metadata or identifiers, and manual redaction guidance is not a reliable privacy control.
The code persists an API key in the skill's state store with no indication of encryption, scoping limits, expiry, or user consent. In a payment skill, storing long-lived credentials increases the risk of unauthorized payment actions or account linkage abuse if the local state is exposed, reused across sessions, or accessed by other components.
initiatePayment executes a payment request using stored credentials and merchant parameters without enforcing any confirmation check, even though a confirm field is read from input. In a payment skill, failing to require explicit user confirmation before sending a live transaction materially increases the risk of unauthorized or accidental charges triggered by prompt confusion, agent misuse, or malicious tool invocation.
Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal
