Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to provide the advertised paid URL-checking service, but it should be reviewed because it repeatedly asks users to run an unpinned remote CLI in wallet and paid-service workflows.
Review before installing. Use only for specific URLs you intend to check, avoid sending private order or tokenized URLs unless necessary, protect webhook secrets and owner tokens, and prefer a pinned reviewed `agentcash` version instead of `@latest` before using wallet or paid endpoint commands.
The manifest itself advertises use of npx agentcash@latest, embedding the unsafe execution model into the skill's top-level interface. Because manifests are often parsed or surfaced automatically, this increases systemic risk by propagating an unpinned supply-chain dependency across integrations.
The trigger phrases are broad everyday language such as 'before I buy' or 'tell me when', which can cause the skill to activate in contexts beyond its intended scope. Over-broad triggering is dangerous because it may route unrelated user requests into a networked, paid, and potentially sensitive capability without sufficiently explicit user intent.
The skill instructs users to run npx agentcash@latest, which fetches and executes whatever package version is current at runtime rather than a reviewed, immutable version. This creates a supply-chain risk: a compromised upstream package, account takeover, or malicious update could cause arbitrary code execution in the user's environment.
The skill is presented as a live availability checker for listings, products, and jobs, but it also exposes form-submission and order-confirmation functions. This scope expansion can mislead operators and agents into using the skill in higher-sensitivity workflows involving transactional or personal data that were not clearly disclosed in the skill's stated purpose.
This invocation again relies on npx ...@latest, so the actual code executed is not stable or auditable from the skill text alone. In an agent skill context, encouraging repeated use of floating executable dependencies increases the chance of silent compromise through package tampering or malicious releases.
The skill tells operators to run a schema-discovery command via an unpinned package version, which could execute attacker-controlled code if the package supply chain is compromised. Because this is a prerequisite step before any endpoint usage, it broadens exposure and normalizes unsafe execution habits.
This example uses the same floating @latest package reference for the check endpoint, preserving the same arbitrary code execution and supply-chain exposure. Repetition across multiple examples increases the likelihood that users will copy and run the unsafe pattern.
The watch workflow includes an unpinned executable package invocation, which is particularly sensitive because it sets up long-lived monitoring and callback configuration. A malicious package version could exfiltrate webhook secrets, URLs, or other operator data during setup.
Form and order confirmation operate on thank-you pages and order-status URLs, which can contain references, identifiers, or other sensitive transactional context, yet these features are not justified by the core 'live page availability' purpose. That mismatch increases the risk of over-collection, accidental data exposure, and misuse in contexts requiring stronger controls than simple availability checks.
The confirm example executes an unpinned package version while handling confirmation URLs that may include sensitive references or tokens. If the package is compromised, those URLs and associated metadata could be harvested or abused.
This order-confirmation example repeats the same unpinned package execution pattern in a context that may involve order identifiers or customer transaction metadata. The combination of remote code execution risk and potentially sensitive commerce data makes the pattern materially dangerous.
The workflow example for verifying merchant URLs again uses a floating executable dependency. Even though the command appears simple, it still permits arbitrary code execution from the package registry and should be treated as a supply-chain vulnerability.
The documentation instructs users to run npx agentcash@latest balance, which fetches and executes the latest published package version at runtime. Using @latest is effectively unpinned and creates a supply-chain risk: if the package or publisher is compromised, users may execute malicious code without any review. In a payment-related skill that handles wallet operations, this raises the stakes because compromise could expose funds or credentials.
The command npx agentcash@latest redeem YOUR_CODE executes whatever version is currently published as latest, making the setup flow vulnerable to malicious package updates or account takeover of the package publisher. Because this step interacts with wallet funding or redemption, exploitation could directly lead to theft of funds, secrets, or account manipulation.
The guidance to run npx agentcash@latest accounts again relies on executing an unpinned remote package at runtime. Since this command reveals deposit links and wallet addresses, a compromised package could misdirect deposits, exfiltrate wallet metadata, or present attacker-controlled payment details.
The command npx agentcash@latest check https://livecheck.fly.dev/v1/verify causes users to execute the newest package version when validating the service schema. Even though the purpose is benign, runtime execution of an unpinned CLI remains a supply-chain exposure, and the skill context increases concern because the tool is tied to paid API interactions and wallet settlement.
No suspicious patterns detected.
