ClawHub
Back to skill

Security audit

Openclaw Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for payment guardrails, but it delegates real purchases and crypto payments to automatic policy approval and runs an unpinned MCP package with a payment token.

Install only if you are comfortable with policy-approved purchases proceeding without a fresh confirmation prompt. Use very small budgets, disable or tightly limit auto-approval for anything valuable, keep payment credentials outside the agent environment, prefer manual approval for high-value purchases, pin and review the MCP package version, and rotate the LETAGENTPAY_TOKEN if you suspect package or host compromise.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:143
Finding
Unpinned MCP Package Is Automatically Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md:143-145`, `SKILL.md:163-165`, `README.md:42-44`, and `README.md:75-77` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code `SKILL.md:143-145`: ```json "letagentpay": { "command": "npx", "args": ["-y", "letagentpay-mcp"], ``` The same configuration is repeated in `SKILL.md:163-165`. `README.md:42-44`: ```json "letagentpay": { "command": "npx", "args": ["-y", "letagentpay-mcp"], ``` The same configuration is repeated in `README.md:75-77`. Additional unpinned SDK installation recommendations appear at `README.md:109-110`: ```markdown - **Python**: `pip install letagentpay` ([GitHub](https://github.com/LetAgentPay/letagentpay-python)) - **TypeScript**: `npm install letagentpay` ([GitHub](https://github.com/LetAgentPay/letagentpay-js)) ``` ### Technical Analysis The recommended OpenClaw configuration launches `npx` with the `-y` option and the unversioned package name `letagentpay-mcp`. If the package is not already available locally, `npx` may retrieve the current package release from the configured npm registry and execute it without interactive confirmation. Because neither an exact package version nor an integrity digest is specified, the code executed by this configuration can change after the Skill has been reviewed. The implementation of the MCP server is not included in the audited project, so its runtime behavior and the documentation's claims about token scope and server-side policy enforcement cannot be independently verified from this artifact. This is a supply-chain trust weakness rather than evidence that the current package is malicious. Exploitation would require compromise of the package, its publisher account, the configured registry, or a future package release. ### Attack Path 1. A user copies the documented MCP configuration into OpenClaw. 2. OpenClaw invokes ...[truncated 1368 chars]
Remediation
## Remediation Suggestions 1. Replace the unversioned package name with an exact, reviewed version, for example: ```json { "command": "npx", "args": ["-y", "letagentpay-mcp@1.2.3"] } ``` The example version must be replaced with a release that has actually been reviewed. 2. Prefer an explicit installation process backed by a committed lockfile rather than downloading a package dynamically whenever the MCP server starts. 3. Verify package provenance and integrity using registry integrity metadata, trusted publishing, release signatures, or independently recorded cryptographic hashes. 4. Remove automatic confirmation where practical so unexpected dependency retrieval does not occur silently. 5. Run the MCP server in a restricted environment with: - A dedicated low-privilege operating-system account or container. - Minimal filesystem access. - Network access limited to required service endpoints. - Only the required environment variable. - No unrelated payment credentials or user secrets. 6. Assign the agent token the minimum server-side permissions necessary and support prompt revocation and rotation if dependency compromise is suspected. 7. Pin versions in the optional `pip install` and `npm install` SDK examples as well, and document the use of lockfiles and hash verification.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
8. Monthly spending limit
9. Total budget

If all checks pass and auto-approve criteria are met, the purchase proceeds instantly. Otherwise, you get a notification in your chat to approve or reject.

## Quick Start
Confidence
85% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
8. Monthly spending limit
9. Total budget

If all checks pass and auto-approve criteria are met, the purchase proceeds instantly. Otherwise, you get a notification in your chat to approve or reject.

## Quick Start
Confidence
85% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium
Category
Rogue Agent
Content
### 1. Get a token

Sign up at [letagentpay.com](https://letagentpay.com) and create an agent to get your `agt_xxx` token.

Or self-host: see [self-hosting docs](https://github.com/LetAgentPay/letagentpay).
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- `agent_comment` — explain WHY this purchase is needed (shown to the human reviewer)

**Response statuses:**
- `auto_approved` — purchase approved automatically, proceed with buying
- `pending` — sent to human for manual review, do NOT proceed yet
- `rejected` — policy denied this purchase, do NOT proceed
Confidence
88% confidence
Finding
The documented 'auto_approved' path tells the agent to proceed with buying once the policy engine approves, which enables autonomous spending without a fresh user authorization at execution time. Even though guardrails exist, this still delegates real purchasing decisions to the agent and policy engine, so prompt manipulation, misclassification of the purchase, or user misunderstanding could result in unwanted transactions.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
2. **Check budget** — call `check_budget` to see remaining funds
3. **Request purchase** — call `request_purchase` with amount, category, and a clear `agent_comment` explaining the need
4. **Handle result:**
   - If `auto_approved`: proceed with the purchase, then call `confirm_purchase`
   - If `pending`: tell the user the request is awaiting approval. Do NOT proceed. Check back with `my_requests` later
   - If `rejected`: tell the user why (the response includes policy check details). Do NOT attempt the purchase
5. **Confirm** — after completing the purchase, always call `confirm_purchase`
Confidence
90% confidence
Finding
The workflow repeats the instruction that if a request is 'auto_approved' the agent should proceed with the purchase and then confirm it afterward, again normalizing autonomous execution of purchases. In a payment skill, that context makes the issue more dangerous because the capability is directly tied to spending money, so any mistaken approval or manipulated request can immediately translate into financial loss.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly instructs the agent to 'sign and send the on-chain transaction' after authorization, but it does not require an explicit user-facing confirmation or warning that real funds will move and that blockchain transfers are typically irreversible. In the context of an autonomous agent skill, this increases the chance of unintended fund movement, especially if the user did not understand that x402 payment authorization can trigger actual wallet spending.

Static analysis

No suspicious patterns detected.