Payment Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:24 AM UTC
• Version: 1.0.3

Overview

The skill broadly matches its payment purpose, but it should be reviewed before installation because it can handle payment secrets and initiate refunds without strong built-in safeguards.

Install only if you trust the publisher and can enforce operational controls outside the skill: require HTTPS-only API endpoints, do not run setup with real payment credentials in the environment, rotate any credentials whose fragments may have appeared in logs, update vulnerable dependencies, and require an explicit approval workflow for refunds before allowing production use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: src/payment_api_client.py:52

Finding

Payment API credentials may be transmitted over plaintext HTTP

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/payment_skill.py:220

Finding

Refund approval requirement is declared but not enforced

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/diagnose.py:209

Finding

Installation diagnostics disclose portions of payment credentials

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/security.py:115

Finding

Weak encryption keys are silently accepted through zero padding

Content

View full analysis

"DataEncryption": import os key_str = os.environ.get(env_key) if not key_str: raise ValueError(f"环境变量 {env_key} 未设置，生产环境必须提供加密密钥") key_bytes = key_str.encode()[:32].ljust(32, b'0') return cls(key_bytes) ``` ### Technical Analysis The constructor requires a 32-byte key, but `from_env` converts any nonempty string into 32 bytes by truncating long values and padding short values with predictable ASCII zero bytes. A one-character password therefore becomes a formally valid AES-256 key even though its effective entropy is extremely low. Padding does not constitute a password-based key derivation function. It creates deterministic, easily guessed keys and can make operators believe that AES-256 strength is being provided when security is actually limited by the original string. Truncating encoded Unicode input can also produce ambiguous or invalid key handling. AES-GCM is an appropriate authenticated encryption mode, but its security depends on unpredictable keys. The serialization of ciphertext, nonce, and tag with Base64 is normal and is not itself an exfiltration mechanism. ### Attack Path 1. An operator configures a short or human-memorable `PAYMENT_ENCRYPTION_KEY`. 2. `from_env` pads that value with predictable zero bytes. 3. Sensitive fields are encrypted using the resulting low-entropy AES key. 4. An attacker obtains encrypted output through storage exposure, logs, backups, or another application flaw. 5. The attacker constructs likely candidate strings, applies the same truncation and padding algorithm, and tests candidates using the GCM authentication tag. 6. A matching tag confirms the correct key and permits decryption of protected fields. ### Impact Asses ...[truncated 350 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:54

Finding

Dependency installation does not verify package integrity

Content

View full analysis

Remediation

View remediation

`. 3. Configure an explicitly trusted package index and prevent unintended fallback to public or extra indexes. 4. Pin the pip version rather than upgrading to an unconstrained latest release during setup. 5. Verify downloaded artifacts in a controlled build pipeline and deploy from an internal, immutable artifact repository. 6. Separate runtime dependencies from test and optional dependencies so production installs receive only required packages. 7. Retire Python 3.6 support and remove its legacy dependency manifest. 8. Run dependency vulnerability and license scanning in CI, and establish a regular update process. 9. Execute installation without administrative privileges and without production payment credentials in the environment. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: src/payment_api_client.py:55

Finding

Request signature may use a different timestamp from the transmitted header

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (37)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Providing undeclared generic validation and encryption/decryption utilities while lacking core payment functionality is a strong description-behavior mismatch. While those helpers are not inherently malicious, hiding extra cryptographic or data-processing capabilities inside a payment-branded skill can enable misuse and defeats informed consent by the operator.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Providing undeclared generic validation and encryption/decryption utilities while lacking core payment functionality is a strong description-behavior mismatch. While those helpers are not inherently malicious, hiding extra cryptographic or data-processing capabilities inside a payment-branded skill can enable misuse and defeats informed consent by the operator.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

Providing undeclared generic validation and encryption/decryption utilities while lacking core payment functionality is a strong description-behavior mismatch. While those helpers are not inherently malicious, hiding extra cryptographic or data-processing capabilities inside a payment-branded skill can enable misuse and defeats informed consent by the operator.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Providing undeclared generic validation and encryption/decryption utilities while lacking core payment functionality is a strong description-behavior mismatch. While those helpers are not inherently malicious, hiding extra cryptographic or data-processing capabilities inside a payment-branded skill can enable misuse and defeats informed consent by the operator.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: aiohttp==3.6.3 — 16 advisory(ies): CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi); CVE-2026-34517 (AIOHTTP has late size enforcement for non-file multipart fields causes memory Do) +13 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Pinning aiohttp to 3.6.3 introduces a dependency version with multiple published security advisories, including request/header handling and multipart-related issues. In a payment skill that likely performs network I/O, a vulnerable HTTP client materially increases exposure to denial of service, header injection, cookie handling, or other request-processing attacks.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: pydantic==1.8.2 — 2 advisory(ies): CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2024-3772 (Pydantic regular expression denial of service)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Pydantic 1.8.2 is flagged for a regular-expression denial-of-service issue. If this payment skill validates attacker-controlled input such as payment metadata, webhook payloads, or user fields, crafted input could trigger excessive CPU consumption and degrade availability.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: cryptography==3.4.8 — 16 advisory(ies): CVE-2023-50782 (Python Cryptography package vulnerable to Bleichenbacher timing oracle attack); GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels); GHSA-5cpq-8wj7-hf2v (Vulnerable OpenSSL included in cryptography wheels) +13 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

cryptography 3.4.8 is associated with multiple advisories, including cryptographic weaknesses and vulnerable bundled OpenSSL components. In a payment-oriented skill, cryptographic assurance is central; outdated crypto dependencies can undermine confidentiality, integrity, and trust boundaries around secrets, tokens, or TLS-related operations.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: pycryptodome==3.10.4 — 2 advisory(ies): CVE-2023-52323 (PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption); CVE-2023-52323 (PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

pycryptodome 3.10.4 is flagged for a side-channel issue affecting OAEP decryption. In a payment context, where encrypted secrets, tokens, or sensitive payloads may be processed, side-channel leakage can be especially serious because it may aid key recovery or plaintext inference under certain attack conditions.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: pytest==6.2.5 — 2 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

pytest is a development/test dependency, so its vulnerable tmpdir handling is less likely to affect production runtime directly. However, it can still matter in CI, local testing, or shared build environments where malicious test inputs or filesystem manipulation could impact integrity or leak data.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: aiohttp==3.9.5 — 16 advisory(ies): CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi); CVE-2026-34517 (AIOHTTP has late size enforcement for non-file multipart fields causes memory Do) +13 more

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The file pins aiohttp==3.9.5, and the static analysis reports multiple known advisories including CRLF injection and cookie-handling issues. In a payment-related skill, HTTP client security matters because outbound requests may carry tokens, session state, or sensitive transaction metadata, so vulnerable request parsing or cookie behavior can increase risk substantially.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: cryptography==42.0.5 — 11 advisory(ies): GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels); CVE-2024-12797 (Vulnerable OpenSSL included in cryptography wheels); GHSA-h4gh-qq45-vh27 (pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels) +8 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

cryptography==42.0.5 is reported to include vulnerable OpenSSL components in some wheels, which is particularly serious in a payment skill that likely relies on TLS, key handling, signatures, or encryption. Weaknesses in foundational crypto dependencies can undermine confidentiality and integrity even if the application code appears correct.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: pytest==8.2.0 — 2 advisory(ies): GHSA-6w46-j5rx-g56g; PYSEC-2026-1845

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

pytest==8.2.0 is a known vulnerable dependency according to the reported advisories, but it is listed under test dependencies rather than production runtime. That reduces direct exploitability in deployed payment functionality, though it can still affect CI environments, developer systems, or any pipeline that processes untrusted test inputs.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/config_loader.py (reported line 37)May include surrounding context.

python

配置字典
        """
        config_dir = ConfigLoader.get_config_dir()
        env_file = config_dir / f"{env_name}.env"
        
        if not env_file.exists():
            logger.warning(f"配置文件不存在: {env_file}")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill advertises executable behavior involving environment access, file reads, network, and shell execution, yet the manifest does not declare any explicit tool scope such as permissions or allowed-tools. In a payment context, this is risky because the skill handles secrets and can run setup scripts, making it harder for a host or reviewer to constrain what the skill may access or execute.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The refund operation can trigger irreversible or financially destructive actions, but the documentation does not provide an explicit warning or confirmation requirement. In a payment skill, that omission raises the risk of accidental or unauthorized refunds initiated by an agent or user without understanding the consequences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file’s natural-language description and all user-facing messages are written exclusively in Chinese, indicating the skill is designed to operate in a single language. There is no indication that the user can choose another language or that the Chinese-only constraint is required for a documented region-specific purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This script performs broad environment and project reconnaissance unrelated to core payment processing, including enumerating dependencies, project files, interpreter details, and configuration state. In a skill context, such host introspection increases the amount of internal metadata exposed to the operator or logs and can aid follow-on attacks or unauthorized profiling of the runtime environment.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnose.py (reported line 67)May include surrounding context.

python

print_header("pip 版本检查")
    
    try:
        result = subprocess.run(
            [sys.executable, "-m", "pip", "--version"],
            capture_output=True,
            text=True

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script reads payment-related environment variables, including API keys and secrets, and prints masked portions of their values. Even partial secret disclosure confirms presence, format, and fragments of credentials, which can leak into logs, screenshots, CI output, or support channels and materially weaken secret confidentiality.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: python-dotenv==0.19.0 — 2 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)

Medium

• Category: Supply Chain
• Confidence: 85% confidence

Finding

python-dotenv 0.19.0 has an advisory involving unsafe symlink handling in set_key/arbitrary file overwrite scenarios. While exploitability depends on whether the skill writes .env files or runs in an attacker-influenced filesystem context, the vulnerable version still represents a real supply-chain risk.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 2 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)

Medium

• Category: Supply Chain
• Confidence: 88% confidence

Finding

python-dotenv==1.0.1 is flagged for a symlink-following issue in set_key that can enable arbitrary file overwrite in some usage patterns. While a requirements file alone does not prove the vulnerable API is used, including a version with known security issues is still a real dependency risk, especially if deployment or tooling modifies .env files during setup or runtime.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file's user-facing docstring, help text, and runtime messages are written in Chinese, which effectively imposes a specific language on users. The policy allows locale constraints only when justified or when the user is given a language choice, neither of which appears in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code exposes a refund_payment command, which is an irreversible or safety-critical operation, but the CLI only labels it as '发起退款' and does not present any confirmation prompt or explicit warning at execution time. Although the command name indicates purpose, there is no user disclosure in the execution path that the action may reverse a prior transaction and affect funds.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

All user/developer-facing natural-language text in docstrings, log messages, and exception strings is written exclusively in Chinese, with no indication that language choice is configurable or limited to a justified locale-specific context. This can violate language/locale policy when the skill is expected to operate in a broader environment without explicit opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest describes a payment solution, but this module implements local configuration and secret discovery via os.getenv and direct reads of config/*.env files. While payment processing may need credentials, broad environment-variable and local file access is a separate capability not stated in the manifest and expands the skill's reach into host configuration.

Content

No source excerpt is available for this finding.