Openclaw Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:21 AM UTC
• Version: 1.2.0

Overview

The skill is coherent for payment guardrails, but it delegates real purchases and crypto payments to automatic policy approval and runs an unpinned MCP package with a payment token.

Install only if you are comfortable with policy-approved purchases proceeding without a fresh confirmation prompt. Use very small budgets, disable or tightly limit auto-approval for anything valuable, keep payment credentials outside the agent environment, prefer manual approval for high-value purchases, pin and review the MCP package version, and rotate the LETAGENTPAY_TOKEN if you suspect package or host compromise.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:143

Finding

Unpinned MCP Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:143-145, SKILL.md:163-165, README.md:42-44, and README.md:75-77
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

SKILL.md:143-145:

json

"letagentpay": {
  "command": "npx",
  "args": ["-y", "letagentpay-mcp"],

The same configuration is repeated in SKILL.md:163-165.

README.md:42-44:

json

"letagentpay": {
  "command": "npx",
  "args": ["-y", "letagentpay-mcp"],

The same configuration is repeated in README.md:75-77.

Additional unpinned SDK installation recommendations appear at README.md:109-110:

markdown

- **Python**: `pip install letagentpay` ([GitHub](https://github.com/LetAgentPay/letagentpay-python))
- **TypeScript**: `npm install letagentpay` ([GitHub](https://github.com/LetAgentPay/letagentpay-js))

Technical Analysis

The recommended OpenClaw configuration launches npx with the -y option and the unversioned package name letagentpay-mcp. If the package is not already available locally, npx may retrieve the current package release from the configured npm registry and execute it without interactive confirmation.

Because neither an exact package version nor an integrity digest is specified, the code executed by this configuration can change after the Skill has been reviewed. The implementation of the MCP server is not included in the audited project, so its runtime behavior and the documentation's claims about token scope and server-side policy enforcement cannot be independently verified from this artifact.

This is a supply-chain trust weakness rather than evidence that the current package is malicious. Exploitation would require compromise of the package, its publisher account, the configured registry, or a future package release.

Attack Path

1. A user copies the documented MCP configuration into OpenClaw.
2. OpenClaw invokes ...[truncated 1368 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unversioned package name with an exact, reviewed version, for example:

   json

   {
     "command": "npx",
     "args": ["-y", "letagentpay-mcp@1.2.3"]
   }
   

   The example version must be replaced with a release that has actually been reviewed.

2. Prefer an explicit installation process backed by a committed lockfile rather than downloading a package dynamically whenever the MCP server starts.

3. Verify package provenance and integrity using registry integrity metadata, trusted publishing, release signatures, or independently recorded cryptographic hashes.

4. Remove automatic confirmation where practical so unexpected dependency retrieval does not occur silently.

5. Run the MCP server in a restricted environment with:

   • A dedicated low-privilege operating-system account or container.
   • Minimal filesystem access.
   • Network access limited to required service endpoints.
   • Only the required environment variable.
   • No unrelated payment credentials or user secrets.

6. Assign the agent token the minimum server-side permissions necessary and support prompt revocation and rotation if dependency compromise is suspected.

7. Pin versions in the optional pip install and npm install SDK examples as well, and document the use of lockfiles and hash verification.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

md

8. Monthly spending limit
9. Total budget

If all checks pass and auto-approve criteria are met, the purchase proceeds instantly. Otherwise, you get a notification in your chat to approve or reject.

## Quick Start

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

md

8. Monthly spending limit
9. Total budget

If all checks pass and auto-approve criteria are met, the purchase proceeds instantly. Otherwise, you get a notification in your chat to approve or reject.

## Quick Start

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 25)May include surrounding context.

md

### 1. Get a token

Sign up at [letagentpay.com](https://letagentpay.com) and create an agent to get your `agt_xxx` token.

Or self-host: see [self-hosting docs](https://github.com/LetAgentPay/letagentpay).

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The documented 'auto_approved' path tells the agent to proceed with buying once the policy engine approves, which enables autonomous spending without a fresh user authorization at execution time. Even though guardrails exist, this still delegates real purchasing decisions to the agent and policy engine, so prompt manipulation, misclassification of the purchase, or user misunderstanding could result in unwanted transactions.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

- `agent_comment` — explain WHY this purchase is needed (shown to the human reviewer)

**Response statuses:**
- `auto_approved` — purchase approved automatically, proceed with buying
- `pending` — sent to human for manual review, do NOT proceed yet
- `rejected` — policy denied this purchase, do NOT proceed

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The workflow repeats the instruction that if a request is 'auto_approved' the agent should proceed with the purchase and then confirm it afterward, again normalizing autonomous execution of purchases. In a payment skill, that context makes the issue more dangerous because the capability is directly tied to spending money, so any mistaken approval or manipulated request can immediately translate into financial loss.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md

2. **Check budget** — call `check_budget` to see remaining funds
3. **Request purchase** — call `request_purchase` with amount, category, and a clear `agent_comment` explaining the need
4. **Handle result:**
   - If `auto_approved`: proceed with the purchase, then call `confirm_purchase`
   - If `pending`: tell the user the request is awaiting approval. Do NOT proceed. Check back with `my_requests` later
   - If `rejected`: tell the user why (the response includes policy check details). Do NOT attempt the purchase
5. **Confirm** — after completing the purchase, always call `confirm_purchase`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs the agent to 'sign and send the on-chain transaction' after authorization, but it does not require an explicit user-facing confirmation or warning that real funds will move and that blockchain transfers are typically irreversible. In the context of an autonomous agent skill, this increases the chance of unintended fund movement, especially if the user did not understand that x402 payment authorization can trigger actual wallet spending.

Content

No source excerpt is available for this finding.