Security audit

asndurl

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent payment CLI guide, but it handles real payment authority and private agent keys in ways users should review carefully before installing.

Install only if you trust the Ampersend npm package and publisher. Use the browser approval flow instead of pasting private keys into commands, set tight per-transaction/daily/monthly limits, avoid auto-topup unless you fully understand the risk, and use --inspect before paid fetches. If a private agent key was already entered on a command line or shared in an agent transcript, consider rotating it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unverified Global Installation of a Third-Party Financial Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:59
Finding: Private Agent Key Passed Through Command-Line Arguments
Content: View full analysis
# Set active config manually ampersend config set --api-url # Set both at once ``` ### Technical Analysis The manual setup interface places the private agent key directly in a command-line argument. Quoting the value only affects shell parsing; it does not protect the secret from exposure. Depending on the operating system and execution environment, command arguments may be visible through process inspection, shell history, terminal capture, audit logging, telemetry, crash reports, job-runner logs, or agent conversation transcripts. The combined `key:::account` format also encourages users to copy the private key into plaintext interfaces. If the CLI stores the supplied key without restrictive file permissions or secure secret storage, the exposure may persist after the command terminates. The available artifact does not document storage protections. ### Attack Path 1. A user or agent follows the manual configuration instructions. 2. The private agent key is inserted directly into the `ampersend config set` command. 3. The shell, automation platform, terminal logger, process monitor, or audit subsystem records or observes the complete argument. 4. An attacker with access to local process metadata, history files, execution logs, or transcripts extracts the key. 5. The attacker imports the key in ...[truncated 870 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly enables autonomous payments using stablecoins and states that agents can make payments without human approval for each transaction, but it does not present a prominent warning that real funds may be moved and costs may be incurred. In a payment-focused skill, this omission increases the chance of unintentional spending by users or downstream agents, especially when paired with simple example commands.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
md
## Security **IMPORTANT**: NEVER ask the user to sign in to the Ampersend dashboard in a browser to which you have access. If configuration changes are needed in Ampersend, ask your user to make them directly. ## Setup

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
Use --inspect to verify payment requirements and costs before making a payment:

bash
ampersend fetch --inspect https://api.example.com/paid-endpoint # Returns payment requirements including amount, without executing payment

Static analysis

No suspicious patterns detected.