T08 · Insecure Dependencies
Error
- Location
SKILL.md:59- Finding
Unpinned Third-Party Payment Package Is Downloaded and Executed Automatically
- Content
View full analysis
- Remediation
View remediation
Security audit
Accounts Payable Agent
Security checks for vulnerabilities and agentic risk
Overview
This skill is for real autonomous payments and is openly about that purpose, but its instructions and examples leave too much payment authority and dependency execution under-scoped for automatic installation.
Review this carefully before installing. Use only narrowly scoped payment credentials, pin and verify the MCP package, run it in a restricted environment, require server-side spend limits and approvals, and do not allow raw inter-agent requests or scheduled records to directly control payment recipients or amounts.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:124- Finding
Payment Workflows Bypass Required Recipient, Limit, and Idempotency Controls
- Content
View full analysis
SPEND_LIMIT) { await escalate(bill, "Exceeds autonomous payment limit"); continue; } const result = await agenticbtc.sendPayment({ to: bill.recipient, amount: bill.amount, currency: bill.currency, reference: bill.invoiceId, memo: bill.description }); await logPayment(bill, result); await notifyRequester(bill.requestedBy, result); } ``` The inter-agent workflow checks the reference for an existing payment, but it forwards the request's recipient and amount without enforcing a spend limit, approved-vendor lookup, or recipient-account confirmation: ```typescript async function processContractorPayment(request: { contractor: string; milestone: string; amount: number; invoiceRef: string; }) { const alreadyPaid = await agenticbtc.checkPaymentByReference({ reference: request.invoiceRef }); if (alreadyPaid.paid) return { status: "already_paid", ...alreadyPaid }; const payment = await agenticbtc.sendPayment({ to: request.contractor, amount: request.amount, currency: "USD", reference: request.invoiceRef, memo: `Milestone: ${request.milestone}` }); return { status: "sent", paymentId: payment.id, confirmedAt: payment.timestamp }; } ``` ### Technical Analysis The Skill states that every payment must be idempotent, that payments over $50 require recipient-address confirmation, and that transactions above the authorized limit require explicit human approval. The example wo ...[truncated 2632 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:50- Finding
Automatic Cross-Rail Fallback Can Produce Duplicate Payments After Ambiguous Failures
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file presents all natural-language guidance, role definition, rules, and workflow descriptions only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not stated here.
- Content