Ovra Payments

• Outcome: Review
• Latest audit: May 29, 2026, 9:32 PM
• Version:
  1.0.0

Overview

This payment skill is not deceptive, but it grants broad real-money and account-management authority that users should review carefully before installing.

Install only if you trust Ovra with payment intent, merchant, amount, transaction, and receipt data. Use sandbox or restricted keys first, require explicit confirmation before any real purchase, and verify that the backend enforces approval for card, token, agent, policy, and GDPR actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill is presented as a payment helper, but it also exposes sensitive administrative and data-governance capabilities such as token creation/revocation, agent provisioning, GDPR export/delete, and system configuration. This mismatch increases the chance an agent or integrator grants the skill broader authority than intended, enabling destructive or privacy-impacting actions under the guise of routine checkout functionality.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The human-boundary guidance is inconsistent with the actual toolset: it mentions agent deletion that is not exposed, while failing to clearly gate other sensitive actions that are exposed, such as token management and GDPR operations. Ambiguous safety boundaries can cause agents or operators to incorrectly assume certain high-risk actions are safe to automate, leading to unauthorized account changes or irreversible data deletion.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The README promotes an extremely broad activation phrase ('buy X') for a skill that can initiate real-world payments. In an agentic context, such loose triggering increases the risk of accidental invocation from ordinary conversation, potentially causing unauthorized purchase attempts or unintended sharing of purchase metadata with the payment provider.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill description emphasizes convenience and safety but omits a prominent warning that using the skill may initiate a real purchase and transmit order, merchant, and transaction-related data to Ovra's external service. For a payments skill, this missing disclosure is dangerous because users may trigger spending behavior without understanding the financial and privacy consequences.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger guidance says to use the skill even when the user merely says broad terms like 'buy', 'order', 'purchase', 'subscribe', or 'pay for'. Such broad activation criteria can cause unintended invocation of a real-money payment capability, especially in ambiguous or exploratory conversations, raising the risk of accidental purchases or premature checkout flows.

VirusTotal

64/64 vendors flagged this skill as clean.