Security audit

Nicky

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Nicky crypto payment helper with no bundled executable code, though users should understand it shares payer identity details and references optional account-level API-key tools.

Install only if you intend an agent to help with Nicky crypto payments. Before starting a payment, confirm the receiver, asset, exact amount, wallet address, memo, and expiry time yourself, and understand that payer name, payer email, payment attempt IDs, and transaction hashes are sent to Nicky and may be visible to the payment receiver. Only provide NICKY_API_KEY if you want the agent to access private Nicky account-management capabilities, because that endpoint includes sensitive operations beyond simple payment lookup and progress checks.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to collect payerName and payerEmail, but it does not explicitly require a privacy notice or informed consent before sharing that personal data with the payment receiver. In a payment context, this creates a real privacy risk because users may disclose identifying information without understanding it will be transmitted to a third party as part of the payment flow.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.
md
## Failure modes & recovery | Symptom | Likely cause | Recovery | | ------------------------------------------------ | ------------------------------------- | --------------------------------------------------------------------------------------- | | `payment-request` returns 404 | Unknown short ID | Ask the user to re-check the link / short ID | | `start-payment` returns 422 / conflict | Request already paid or expired | Re-fetch the request; if `openAmount == 0`, tell the user the request is settled |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 212)May include surrounding context.
md
## Failure modes & recovery | Symptom | Likely cause | Recovery | | ------------------------------------------------ | ------------------------------------- | --------------------------------------------------------------------------------------- | | `payment-request` returns 404 | Unknown short ID | Ask the user to re-check the link / short ID | | `start-payment` returns 422 / conflict | Request already paid or expired | Re-fetch the request; if `openAmount == 0`, tell the user the request is settled |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The API documentation requires collecting and transmitting payerName and payerEmail to a third-party payment service and explicitly states these fields are receiver-visible, but it provides no guidance to obtain informed user consent or present a privacy notice first. In a payment skill handling cryptocurrency transactions, this can cause unintended disclosure of personally identifiable information to payees and backend services, especially because the payment flow is anonymous and unauthenticated aside from the supplied payer identity fields.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest describes this skill as covering public payment-request discovery and payment flow with no authentication required. This document additionally instructs the agent about a private MCP endpoint and numerous authenticated account-level operations such as profile updates, billing, webhooks, subaccounts, and credit transfers, which materially exceed the stated payment-flow scope.
Content: No source excerpt is available for this finding.