Security audit

ampersend

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent payment CLI integration, but it deserves review because it can enable real autonomous payments and documents payment-key handling through command-line configuration.

Review this carefully before installing. Use it only for payment tasks you explicitly intend, prefer --inspect before fetch, set tight spending limits, avoid auto-topup unless necessary, and avoid pasting real payment keys into shell commands or agent-visible chats. Consider installing and running the CLI in a constrained environment and verifying the npm package provenance before granting it funds or credentials.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:59
Finding: Payment Agent Key Exposed Through Command-Line Arguments
Content: View full analysis
# Set active config manually ampersend config set --api-url https://api.staging.ampersend.ai # Set staging API URL ampersend config set --clear-api-url # Revert to production API ampersend config set --network base-sepolia # Set network (base, base-sepolia) ampersend config set --clear-network # Revert to default network (base) ampersend config set --api-url # Set both at once ampersend config status # Show current status ``` ### Technical Analysis The manual configuration procedure places the payment agent key directly in a command-line argument. Command-line arguments are not an appropriate secret-delivery mechanism because they can be captured by shell history, terminal recording, agent transcripts, process monitoring, audit telemetry, debugging tools, or local process inspection. The key relates to an autonomous stablecoin payment agent. Its disclosure may therefore permit an attacker to impersonate the agent or authorize transactions within the permissions, spending limits, and available balance assigned to that key. ### Attack Path 1. A user follows the documented manual setup command and substitutes the real payment agent key for `0xagentKey`. 2. The command, including the key, is retained in shell history, terminal logs, an agent transcript, process metadata, or monitoring telemetry. 3. An attacker or unauthorized l ...[truncated 780 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:15
Finding: Unverified Global npm Package Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill description, "Ampersend CLI for agent payments," is broad and does not constrain when the skill should be used or require explicit confirmation before initiating payment-capable actions. In an agent setting, overly broad invocation guidance increases the chance the skill is selected in contexts where it can trigger financial operations without sufficiently clear user intent.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
md
## Security **IMPORTANT**: NEVER ask the user to sign in to the Ampersend dashboard in a browser to which you have access. If configuration changes are needed in Ampersend, ask your user to make them directly. ## Setup

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The fetch command is documented as making HTTP requests with automatic x402 payment handling, but the documentation does not prominently warn that a normal fetch may execute real paid transactions. Because payments can occur as a side effect of a network request, an agent or user may invoke it as if it were a standard fetch operation and unintentionally spend funds.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
Use --inspect to verify payment requirements and costs before making a payment:

bash
ampersend fetch --inspect https://api.example.com/paid-endpoint # Returns payment requirements including amount, without executing payment

Static analysis

No suspicious patterns detected.