Security audit

Mag3nt Pay

Security checks across malware telemetry and agentic risk

Overview

This payment skill is coherent with its stated purpose, but it gives agents real spending authority with under-scoped warnings and credential/data handling guidance.

Install only if you intentionally want an agent to make real Mag3nt/USDC payments. Use low-limit or test cards first, keep MAG3NT_API_KEY and MAG3NT_CARD_TOKEN out of shared files/logs, set strict card and mandate caps, require confirmation for meaningful purchases, and review any flow that forwards original request bodies or headers before payment/retry.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The file documents an autonomous payment flow that enables pre-authorized spending by an agent, but it does not prominently warn users about financial risk, scope of authorization, or the consequences of misconfiguration. In a payment skill, this omission is security-relevant because operators may enable autonomous spending without understanding caps, allowed payees, expiry requirements, monitoring expectations, or the risk of unintended purchases if the agent or surrounding workflow is compromised.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation instructs agents to transmit `payer_card_id` and especially `payer_card_token` to an external payment endpoint with no warning, consent boundary, or guidance on secret handling. In an autonomous agent context, this can normalize sending reusable payment credentials in response to untrusted 402 challenges, enabling unauthorized charges or credential misuse if the challenge or destination is spoofed.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The retry flow silently resends the original request body after payment, but the documentation does not warn that this may retransmit sensitive or high-impact data to the original service. In agent workflows, this can cause unintended disclosure, duplicate submission side effects, or payment-plus-data exfiltration if the original endpoint was malicious or incorrectly identified.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The setup guide instructs users to place a live API key and card token into environment variables and shows direct use of those secrets, but it provides no warning about secure storage, least-privilege handling, rotation, logging exposure, or the consequences of credential compromise. In a payment skill, these credentials authorize access to funding instruments, so accidental disclosure through shell history, screenshots, shared .env files, or CI logs could enable unauthorized payments or account misuse.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document describes payment enablement and verification steps without clearly warning that successful configuration allows real spending through the agent's Mag3nt card and payment APIs. In this skill's context, that omission is especially risky because the purpose of the integration is autonomous payment execution, so users may configure live credentials without understanding that subsequent agent actions can trigger real financial transactions.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documentation instructs callers to send both a card secret token and the original request details, including arbitrary headers and body content, to an external payment endpoint. In a payment skill this may be functionally necessary, but without explicit warnings, minimization guidance, or restrictions on sensitive headers/body fields, it creates a real risk of credential leakage, oversharing secrets from the original request, and unintended transmission of confidential user data to the payment processor.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/quickstart.mjs:17