Security audit

iautopay

Security checks across malware telemetry and agentic risk

Overview

The skill is a mostly coherent API-key purchase guide, but it should be reviewed because it documents broad payment actions and sends bearer API keys over plain HTTP.

Review before installing. Use only a dedicated test wallet, verify every recipient, amount, token, chain, and expiry before signing, avoid the generic transfer endpoint unless you explicitly intend to move funds, and do not send real API keys to the documented HTTP user-management URLs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill’s stated purpose is buying and managing API-key access, but it also exposes a general-purpose stablecoin transfer capability. That materially expands the financial authority granted to the skill beyond its declared scope, increasing the chance of unauthorized or socially engineered fund movement.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Documenting a `to` parameter that allows sending USDC to any arbitrary address creates a broadly abusable payment primitive unrelated to the advertised API-key purchase workflow. In an agent setting, this can be repurposed to exfiltrate funds to attacker-controlled wallets under the guise of normal skill usage.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs users to create and submit signed payment authorizations but does not clearly warn that these signatures can cause irreversible token transfers if accepted by the service. Users or downstream agents may treat signing as a harmless authentication step rather than a funds movement authorization.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The generic transfer endpoint can send USDC to any address, yet the documentation lacks a strong warning that this operation irreversibly moves funds. Combined with arbitrary-recipient support, the absence of a high-friction warning materially increases the risk of accidental or manipulated asset loss.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The examples send `Authorization: Bearer YOUR_API_KEY` over plain HTTP to `ipaynapi.gpuart.cn`, exposing credentials and account data to interception or modification by any network observer or malicious intermediary. Because the bearer token grants access to user/account information and API keys, compromise can directly lead to account takeover or data leakage.

Missing User Warnings

High

Confidence: 99% confidence
Finding: This repeated HTTP example normalizes transmitting API keys in plaintext, which can leak credentials and sensitive account metadata over untrusted networks. Repetition makes the issue more dangerous because implementers are more likely to copy insecure usage patterns directly into production workflows.

External Transmission

Medium

Category: Data Exfiltration
Content: Get your user account information, API keys, and usage statistics. **Requires authentication with your API key.** ```bash curl "http://ipaynapi.gpuart.cn/user/me" \ -H "Authorization: Bearer YOUR_API_KEY" ```
Confidence: 97% confidence
Finding: curl "http://ipaynapi.gpuart.cn/user/me" \ -H "Authorization: Bearer YOUR_API_KEY" ``` **Response:** ```json { "success": true, "data": { "user": { "id": "user_xxx", "walletAddr

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.