BoltzPay

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:58 PM UTC
• Version: 0.3.2

Overview

This skill is for paid API access and is mostly transparent about that, but it asks agents to run an unpinned remote npm CLI with payment and wallet credentials and an unlimited default budget.

Treat this as a Review item before installing. Use only dedicated low-balance or test payment credentials, set a strict daily budget, avoid exposing unrelated wallet or Stripe secrets, and prefer a pinned and reviewed CLI version in an isolated environment. Do not let an agent run `fetch` automatically against endpoints you have not explicitly approved.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:4
• Finding: Unpinned Remote npm CLI Executes with Financial Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 4–52 **Vulnerability Type**: Unpinned third-party dependency with access to sensitive payment credentials **Risk Level**: High ### Vulnerable Code ```yaml metadata: {"openclaw": {"emoji": "⚡", "requires": {"bins": ["npx"], "env": ["COINBASE_API_KEY_ID", "COINBASE_API_KEY_SECRET", "COINBASE_WALLET_SECRET"]}, "install": [{"id": "boltzpay-cli", "kind": "node", "label": "BoltzPay CLI"}]}} ``` ```bash npx @boltzpay/cli fetch https://invy.bot/api ``` ```markdown ### x402 (USDC on Base) - `COINBASE_API_KEY_ID` — Your Coinbase CDP API key ID - `COINBASE_API_KEY_SECRET` — Your Coinbase CDP API key secret - `COINBASE_WALLET_SECRET` — Your Coinbase CDP wallet secret ### MPP (Tempo payment channels) - `TEMPO_PRIVATE_KEY` — Tempo wallet private key (hex). Enables MPP one-shot payments and streaming sessions. ### Optional - `NWC_CONNECTION_STRING` — NWC connection string for L402 (Lightning) payments - `STRIPE_SECRET_KEY` — Stripe secret key for Stripe MPP payments - `BOLTZPAY_DAILY_BUDGET` — Daily spending limit in USD (default: unlimited) ``` ### Technical Analysis The Skill instructs agents to execute `@boltzpay/cli` through `npx` without specifying an exact package version or verified integrity value. Consequently, the code executed during a future Skill invocation may differ from the code that existed when the Skill was reviewed. The downloaded CLI executes in an environment explicitly configured with Coinbase API secrets, wallet secrets, and potentially Tempo, Lightning, or Stripe payment credentials. Network access and payment authorization are necessary for the declared paid-API functionality, but allowing a mutable, remotely retrieved dependency to inherit broad financial credentials does not enforce least privilege. The audited project contains no source code or lockfile for `@boltzpay/cli`, so its credential handling, request destinations, transaction validation, and secret-storage ...[truncated 2263 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@boltzpay/cli` to a reviewed, exact version rather than using an unconstrained package reference. 2. Supply and verify a lockfile and package integrity hash. Prefer a reproducible installation process that fails closed if the artifact hash changes. 3. Include the CLI source in the audited package or link directly to the exact source revision corresponding to the pinned release. 4. Correct the provenance documentation so the npm and source links clearly identify the executed `@boltzpay/cli` package rather than only `@boltzpay/sdk`. 5. Run the CLI in an isolated process with only the credential required for the selected payment protocol. Do not expose Coinbase, Tempo, Lightning, and Stripe credentials simultaneously. 6. Use narrowly scoped, revocable credentials and dedicated low-balance wallets. Avoid primary wallets or unrestricted Stripe keys. 7. Require a finite, conservative daily and per-transaction budget. Do not default to unlimited spending. 8. Require explicit user confirmation before each payment and display the protocol, chain, amount, recipient, endpoint, and maximum total charge. 9. Restrict outbound network destinations where practical, separating package retrieval, registry access, payment-provider access, and selected API access. 10. Validate endpoint redirects and payment-recipient changes to prevent a quoted request from being redirected to a different host or recipient. 11. Ensure non-payment commands such as `quote`, `discover`, and `diagnose` run without inheriting payment credentials. 12. Document credential rotation and revocation procedures for users who suspect package or endpoint compromise. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

• Category: YARA Match

Content

n: Pay for API data automatically — multi-protocol (x402 + L402 + MPP), multi-chain, streaming sessions
metadata: {"openclaw": {"emoji": "\u26a1", "requires": {"bins": ["npx"], "env": ["COINBASE_API_KEY_ID", "COINBASE_API_KEY_SECRET", "COINBASE_WALLET_SECRET"]}, "install": [{"id": "boltzpay-cli", "kind": "node", "label": "BoltzPay CLI"}]}}
---

# BoltzPay — Paid API Access for AI Agents

BoltzPay lets AI agents pay for API data automatically. It supports three payment protocols (x402, L402, and MPP) across multiple chains (Base, Solana, Tempo), paying with USDC, Bitcoin Lightning, or Stripe. Agents can discover 5,700+ scored endpoints from the live registry, evaluate pricing, open streaming sessions, and purchase API data in a single workflow.

## Quick Start

Fetch data from a paid API endpoint:

```
npx @boltzpay/cli fetch https://invy.bot/api
```

## Commands

| Command | Description | Credentials Needed |
|---------|-------------|--------------------|
| `npx @boltzpay/cli fetch

• Confidence: 80% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The skill repeatedly instructs users to execute `npx @boltzpay/cli` without pinning an exact package version. Because `npx` resolves and may download the latest published package at runtime, a compromised maintainer account, malicious update, or dependency hijack could cause arbitrary code execution in an environment that also holds payment credentials and wallet secrets.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This command references `npx @boltzpay/cli` with no pinned version, allowing whatever version is current in the registry to be executed. In this skill, that risk is amplified because the tool is intended to process payment actions and may access sensitive environment variables such as API keys and wallet secrets.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: An unpinned `npx` package invocation means users may execute newly published code without review. Even for a non-paying command like `quote`, a malicious package update could still run arbitrary code locally and inspect environment variables or alter outputs to mislead later payment decisions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The `discover` example uses an unpinned `npx` package, which exposes users to supply-chain risk from malicious or compromised future releases. While this specific command may not require credentials, the package still executes on the host and can perform arbitrary actions if tampered with.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: Running `npx @boltzpay/cli` without a version allows unreviewed registry updates to change behavior or execute attacker-controlled code. This is a real supply-chain weakness even if the command only filters registry data, because the package is executed locally before any functional safeguards apply.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The unpinned `discover --query` command has the same package substitution risk as the other examples: `npx` may fetch and execute the latest code available from the registry. In a developer or agent environment, arbitrary package code could exfiltrate secrets, tamper with results, or establish persistence.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This `diagnose` command executes a remotely resolved package without version pinning, creating a straightforward supply-chain execution risk. Because the tool is positioned for automated agent workflows, users may run it in privileged environments where compromise has broader consequences than a normal local CLI.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The `budget` command still relies on unpinned package execution via `npx`, so a malicious upstream update could execute arbitrary code before showing spending information. The surrounding context of financial tooling makes the host environment especially attractive because it may contain wallet and payment secrets.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: An unpinned `history` invocation gives the package author or an attacker controlling the package distribution path the ability to change executed code at any time. Since transaction history is financially sensitive, tampering could also misrepresent payment records or harvest related data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This `wallet` command uses an unpinned package that may access wallet-related data while executing locally. The combination of floating package resolution and access to payment-related environment variables creates a credible path to credential theft or falsified wallet information.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The `discover` example later in the document also uses an unpinned `npx` package, preserving the same supply-chain risk. Repetition increases the likelihood that users will copy unsafe commands directly into environments that may have network and secret access.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This `quote` example remains vulnerable to registry-side package substitution because no exact package version is specified. Even read-like operations can be abused by a malicious package to execute arbitrary code, collect environment data, or provide deceptive pricing information.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: This unpinned `fetch` command is especially dangerous because it is the operation that performs real payments. A malicious package update could not only execute arbitrary code but also misuse configured payment credentials, trigger unauthorized spending, or alter destination/payment logic.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explains that `fetch` pays and returns data, but it lacks a strong explicit warning near the command usage that invoking it performs real paid transactions against third-party APIs. In an agent or automation setting, insufficient disclosure can lead to unintended spending, execution against untrusted endpoints, and surprise use of live wallet credentials.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The later `diagnose` example again executes a floating package version from the registry. In an automation context, repeated unsafe examples normalize a pattern that undermines reproducibility and opens the door to arbitrary code execution via package compromise.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The quick-start and examples collectively encourage using an unpinned remote CLI in a payment-enabled environment. Because this specific occurrence is tied to `fetch`, exploitation could lead to credential exfiltration, unauthorized purchases, or arbitrary host compromise.

Static analysis

No suspicious patterns detected.