Security audit

BoltzPay

Security checks for vulnerabilities and agentic risk

Overview

This skill is for paid API access and is mostly transparent about that, but it asks agents to run an unpinned remote npm CLI with payment and wallet credentials and an unlimited default budget.

Treat this as a Review item before installing. Use only dedicated low-balance or test payment credentials, set a strict daily budget, avoid exposing unrelated wallet or Stripe secrets, and prefer a pinned and reviewed CLI version in an isolated environment. Do not let an agent run `fetch` automatically against endpoints you have not explicitly approved.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

Location: SKILL.md:4
Finding: Unpinned Remote npm CLI Executes with Financial Credentials
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.
n: Pay for API data automatically — multi-protocol (x402 + L402 + MPP), multi-chain, streaming sessions metadata: {"openclaw": {"emoji": "\u26a1", "requires": {"bins": ["npx"], "env": ["COINBASE_API_KEY_ID", "COINBASE_API_KEY_SECRET", "COINBASE_WALLET_SECRET"]}, "install": [{"id": "boltzpay-cli", "kind": "node", "label": "BoltzPay CLI"}]}}

BoltzPay — Paid API Access for AI Agents

BoltzPay lets AI agents pay for API data automatically. It supports three payment protocols (x402, L402, and MPP) across multiple chains (Base, Solana, Tempo), paying with USDC, Bitcoin Lightning, or Stripe. Agents can discover 5,700+ scored endpoints from the live registry, evaluate pricing, open streaming sessions, and purchase API data in a single workflow.

Quick Start

Fetch data from a paid API endpoint:

text
npx @boltzpay/cli fetch https://invy.bot/api

Commands

Command Description Credentials Needed
`npx @boltzpay/cli fetch

Command	Description	Credentials Needed
`npx @boltzpay/cli fetch

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill repeatedly instructs users to execute npx @boltzpay/cli without pinning an exact package version. Because npx resolves and may download the latest published package at runtime, a compromised maintainer account, malicious update, or dependency hijack could cause arbitrary code execution in an environment that also holds payment credentials and wallet secrets.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This command references npx @boltzpay/cli with no pinned version, allowing whatever version is current in the registry to be executed. In this skill, that risk is amplified because the tool is intended to process payment actions and may access sensitive environment variables such as API keys and wallet secrets.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: An unpinned npx package invocation means users may execute newly published code without review. Even for a non-paying command like quote, a malicious package update could still run arbitrary code locally and inspect environment variables or alter outputs to mislead later payment decisions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The discover example uses an unpinned npx package, which exposes users to supply-chain risk from malicious or compromised future releases. While this specific command may not require credentials, the package still executes on the host and can perform arbitrary actions if tampered with.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Running npx @boltzpay/cli without a version allows unreviewed registry updates to change behavior or execute attacker-controlled code. This is a real supply-chain weakness even if the command only filters registry data, because the package is executed locally before any functional safeguards apply.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The unpinned discover --query command has the same package substitution risk as the other examples: npx may fetch and execute the latest code available from the registry. In a developer or agent environment, arbitrary package code could exfiltrate secrets, tamper with results, or establish persistence.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This diagnose command executes a remotely resolved package without version pinning, creating a straightforward supply-chain execution risk. Because the tool is positioned for automated agent workflows, users may run it in privileged environments where compromise has broader consequences than a normal local CLI.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The budget command still relies on unpinned package execution via npx, so a malicious upstream update could execute arbitrary code before showing spending information. The surrounding context of financial tooling makes the host environment especially attractive because it may contain wallet and payment secrets.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: An unpinned history invocation gives the package author or an attacker controlling the package distribution path the ability to change executed code at any time. Since transaction history is financially sensitive, tampering could also misrepresent payment records or harvest related data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This wallet command uses an unpinned package that may access wallet-related data while executing locally. The combination of floating package resolution and access to payment-related environment variables creates a credible path to credential theft or falsified wallet information.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The discover example later in the document also uses an unpinned npx package, preserving the same supply-chain risk. Repetition increases the likelihood that users will copy unsafe commands directly into environments that may have network and secret access.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This quote example remains vulnerable to registry-side package substitution because no exact package version is specified. Even read-like operations can be abused by a malicious package to execute arbitrary code, collect environment data, or provide deceptive pricing information.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This unpinned fetch command is especially dangerous because it is the operation that performs real payments. A malicious package update could not only execute arbitrary code but also misuse configured payment credentials, trigger unauthorized spending, or alter destination/payment logic.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explains that fetch pays and returns data, but it lacks a strong explicit warning near the command usage that invoking it performs real paid transactions against third-party APIs. In an agent or automation setting, insufficient disclosure can lead to unintended spending, execution against untrusted endpoints, and surprise use of live wallet credentials.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The later diagnose example again executes a floating package version from the registry. In an automation context, repeated unsafe examples normalize a pattern that undermines reproducibility and opens the door to arbitrary code execution via package compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The quick-start and examples collectively encourage using an unpinned remote CLI in a payment-enabled environment. Because this specific occurrence is tied to fetch, exploitation could lead to credential exfiltration, unauthorized purchases, or arbitrary host compromise.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

SkillSpector

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

BoltzPay — Paid API Access for AI Agents

Quick Start

Commands

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Missing User Warnings

Rp1

Rp1

Static analysis