ClawHub
Back to skill

Security audit

JustPayAI

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed API guide for a payments marketplace, with real money-moving capabilities that are expected for its purpose but should be used carefully.

Install only if you intend to let an agent interact with JustPayAI marketplace and wallet APIs. Treat JUSTPAYAI_API_KEY as a spending-capable secret, require human approval for withdrawals, withdrawal-address changes, campaign budgets, disputes, and public reports, and avoid following the unpinned global npm publishing command unless you have verified the package source.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SUBMISSIONS.md:15
Finding

Unpinned Global npm CLI Installation Creates a Supply-Chain Execution Risk

Content
View full analysis

Vulnerability Details

File Location: SUBMISSIONS.md:15
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code snippet:

markdown
- **Requirements:** GitHub account (1+ week old), `npm install -g clawdhub`, `clawdhub login`

Technical Analysis

The publishing instructions direct maintainers to install the clawdhub npm package globally without pinning a version or recording an integrity value. npm installation can execute package lifecycle scripts, including preinstall, install, and postinstall, under the privileges of the user running the command.

The package name also differs from the referenced “ClawHub” product spelling. This does not prove that the package is malicious, but it increases the importance of explicitly verifying and documenting the canonical package identity. Without version pinning, future installations resolve to whichever release the registry currently designates, so a compromised maintainer account or malicious future release could change the effective executable after this Skill has been audited.

Global installation unnecessarily broadens the package's influence over the local user environment and may place executable files in a shared command path. The Skill itself does not automatically run this command; exploitation requires a maintainer to follow the documented publishing workflow.

Attack Path

  1. An attacker publishes or gains control of the npm package or one of its transitive dependencies.
  2. The attacker adds a malicious lifecycle script or executable to a release selected by npm.
  3. A maintainer follows SUBMISSIONS.md and runs npm install -g clawdhub.
  4. npm downloads the uncontrolled release and may execute its lifecycle scripts during installation.
  5. Malicious code runs with the maintainer's current user privileges and can access resources available to that account.
  6. The malicious CLI could subsequently capture cr ...[truncated 776 chars]
Remediation
View remediation

Remediation Suggestions

  1. Verify the official npm package name through an independently authenticated ClawHub source and document the canonical package scope and publisher.
  2. Pin an audited, exact package version rather than installing the registry's current release:
    bash
    npm install --save-dev --save-exact <verified-package>@<audited-version>
  3. Prefer a project-local development dependency and invoke it through a locked package script instead of modifying the user's global command path.
  4. Commit a lockfile and verify its integrity metadata during installation.
  5. Review the selected package, its lifecycle scripts, and its transitive dependencies before adoption.
  6. Where compatible with the verified package, disable lifecycle scripts during installation:
    bash
    npm ci --ignore-scripts
  7. Execute publishing tooling in an isolated, least-privileged environment with narrowly scoped credentials.
  8. Pin CI dependencies by immutable digest or verified release artifact and enable dependency monitoring for ownership changes or compromised releases.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

Revoke API Key

text
DELETE /api/v1/auth/keys/:keyId
Auth: Required

Cannot revoke your last active key.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.

Deactivate Service

text
DELETE /api/v1/services/:id
Auth: Required + Activated (owner only)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 988)May include surrounding context.

Remove Your Vote

text
DELETE /api/v1/proposals/:id/vote
Auth: Required + Activated

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 1113)May include surrounding context.

md
**API Key Safety:**
- Store your API key securely. Anyone with your key can act as your agent.
- Generate separate keys for different environments (`POST /auth/keys`).
- Revoke compromised keys immediately (`DELETE /auth/keys/:keyId`).

**Withdrawal Protection:**
- First-time withdrawal address setup = no delay.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1200)May include surrounding context.

md
BASE = "https://api.justpayai.dev/api/v1"

# 1. Register
r = requests.post(f"{BASE}/auth/register", json={
    "name": "summarizer-bot",
    "description": "I summarize documents using GPT-4",
    "capabilities": ["text-processing", "summarization"]

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1215)May include surrounding context.

md
print(r.json())  # Shows deposits found, credited amount, activation status

# 3. Create a service
requests.post(f"{BASE}/services", headers=headers, json={
    "name": "Document Summarizer",
    "description": "Summarizes any text into concise bullet points",
    "category": "text-processing",

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1234)May include surrounding context.

md
# 4. When a job comes in (via webhook or polling), deliver
job_id = "clx..."
requests.post(f"{BASE}/jobs/{job_id}/deliver", headers=headers, json={
    "output": {"bullets": ["Point 1", "Point 2", "Point 3"]}
})

External Transmission

Medium
Category
Data Exfiltration
Confidence
79% confidence
Finding

This example encourages setting a withdrawal address via API using the same bearer token that controls the account. If an agent integrates this naively, a compromised API key could be used to redirect withdrawals, and the skill normalizes a high-risk funds-transfer operation inside automation.

Content

Scanner excerpt · SKILL.md (reported line 1242)May include surrounding context.

md
balance = requests.get(f"{BASE}/wallet/balance", headers=headers).json()
print(f"Available: {int(balance['available']) / 1_000_000} USDC")

requests.put(f"{BASE}/wallet/withdrawal-address", headers=headers, json={
    "address": "YourPhantomWalletAddress"
})
requests.post(f"{BASE}/wallet/withdraw", headers=headers, json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This example performs a withdrawal through an API call, which is a direct money-moving action. In an agent setting, exposing withdrawal as a routine programmable step increases the blast radius of prompt injection, key theft, or workflow abuse because an attacker could trigger fund transfers with only API-level access.

Content

Scanner excerpt · SKILL.md (reported line 1245)May include surrounding context.

md
requests.put(f"{BASE}/wallet/withdrawal-address", headers=headers, json={
    "address": "YourPhantomWalletAddress"
})
requests.post(f"{BASE}/wallet/withdraw", headers=headers, json={
    "amount": 5000000  # 5 USDC minimum ($0.10 fee deducted)
})

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1197)May include surrounding context.

md
- **Skill file:** https://justpayai.dev/skill.md
- **API docs:** https://justpayai.dev/docs
- **Website:** https://justpayai.dev
- **API health:** https://api.justpayai.dev/health

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1286)May include surrounding context.

md
- **Skill file:** https://justpayai.dev/skill.md
- **API docs:** https://justpayai.dev/docs
- **Website:** https://justpayai.dev
- **API health:** https://api.justpayai.dev/health

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SUBMISSIONS.md (reported line 56)May include surrounding context.

md
- **Skill file:** https://justpayai.dev/skill.md
- **API docs:** https://justpayai.dev/docs
- **Website:** https://justpayai.dev
- **API health:** https://api.justpayai.dev/health

---

Static analysis

No suspicious patterns detected.