Security checks for vulnerabilities and agentic risk
Overview
This payment skill is mostly transparent, but it exposes broad financial, account-admin, credential, configuration, and deletion capabilities under loose purchase-oriented activation language.
Review this carefully before installing, especially with production keys. Use sandbox keys first, avoid storing live bearer tokens in plaintext configs where possible, require explicit confirmation for every payment and account-changing action, and do not enable the admin/config/customer deletion tools unless the account policy enforces separate approval and least-privilege access.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T08 · Insecure Dependencies
Warning
Location
README.md:9
Finding
Unpinned Package Execution in Installation Instructions
Content
View full analysis
Vulnerability Details
File Location: README.md, lines 9–11 Vulnerability Type: Unpinned third-party package and mutable source execution Risk Level: Medium
Vulnerable Code:
bash
npx skills add Ovra-Labs/ovra-pay
Technical Analysis
The documented installation command invokes the skills npm package through npx without specifying an audited version. Depending on the local environment and cache state, npx can retrieve and execute the current package release from the configured npm registry.
The requested skill is also identified by the mutable repository reference Ovra-Labs/ovra-pay, rather than an immutable commit identifier or a cryptographically verified artifact. Consequently, the code executed or installed when a user follows this instruction may differ from the two documentation files reviewed during this audit.
This creates a supply-chain boundary in which compromise of the npm package, its publisher account, the referenced repository, or the associated distribution infrastructure could cause users to execute or install unauthorized content.
Attack Path
An attacker compromises the skills npm package, its publisher account, or another component of its distribution process. Alternatively, the attacker compromises the mutable skill repository or its publishing credentials.
The attacker publishes a malicious package release or replaces the content resolved by Ovra-Labs/ovra-pay.
A user follows the documented installation command.
npx retrieves and executes the unpinned current version of the CLI, which then processes the mutable skill reference.
Malicious code executes under the invoking user's account or attacker-controlled skill content is installed into the agent environment.
Impact Assessment
Successful exploitation could execute code with the privileges of the user running npx. Depending on that user's permissions and the behavior of the comp
...[truncated 544 chars]
Remediation
View remediation
Remediation Suggestions
Pin the CLI to a specifically audited version, for example:
bash
Reference the skill through an immutable commit hash or signed release rather than a mutable repository branch.
Publish SHA-256 checksums and cryptographic signatures for released artifacts, and document how users should verify them before installation.
Prefer a non-executing manual installation procedure for security-sensitive environments.
If npx remains supported, recommend disabling automatic confirmation, inspecting the resolved package version, and executing it in a restricted environment without access to production credentials.
Protect publisher and repository accounts with phishing-resistant multi-factor authentication, least-privilege release credentials, protected branches, and audited release automation.
ovra_config exposes system configuration capabilities without justification in a payment-focused skill. Configuration operations are typically highly privileged and can alter security boundaries, service behavior, or integration endpoints, making this especially dangerous if an autonomous agent can access it under the umbrella of a routine purchasing workflow.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content
No source excerpt is available for this finding.
External Transmission
Medium
Category
Data Exfiltration
Confidence
77% confidence
Finding
The example configuration places a bearer API key directly in a JSON snippet under headers, which can lead users to hardcode secrets in config files that may later be committed, logged, or exposed to other tools. In a payment-related skill, leakage of the Ovra API key could enable unauthorized payment actions or misuse of the connected account.
Content
Scanner excerpt · README.md (reported line 31)May include surrounding context.
The phrase Say "buy X" to your AI agent encourages very broad invocation for a high-risk capability: initiating purchases. In the context of a payment skill, loose trigger language increases the chance of accidental checkout flows, ambiguous user authorization, or invocation from casual language that was not intended as binding purchase consent.
Content
No source excerpt is available for this finding.
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The trigger guidance tells the system to use this skill even for broad everyday phrases like 'buy', 'order', 'purchase', 'subscribe', or 'pay for'. Overbroad activation conditions can cause the skill to be selected in ambiguous contexts, increasing the risk of unintended purchases or invocation of powerful payment/account tools without sufficiently specific user intent.
Content
No source excerpt is available for this finding.
External Transmission
Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding
The skill requires network access to an external MCP endpoint and an API key, meaning prompts, payment metadata, and operational requests will be transmitted off-platform. External transmission is expected for a payments skill, but it still carries security and privacy risk because sensitive purchase intents and attached data leave the local agent boundary.
Content
Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
md
license: MIT
compatibility: >
Requires OVRA_API_KEY (get at https://getovra.com/dashboard/keys) and
MCP server connection to https://api.getovra.com/api/mcp. Network access
to api.getovra.com required. Sandbox keys (sk_test_*) available for testing.
requires:
env:
External Transmission
Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · README.md (reported line 25)May include surrounding context.
The prerequisites explicitly instruct operators to connect to an external MCP server for payment operations, confirming that user and transaction data will leave the agent environment. In the context of a payments skill this is expected, but it remains sensitive because transaction intents, merchant details, and potentially receipt data are transmitted to a third party.
Content
Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.
md
## Prerequisites
1. **Ovra API Key** — sign up at [getovra.com](https://getovra.com) and get a key from [Dashboard > Keys](https://getovra.com/dashboard/keys)
2. **MCP Server Connection** — this skill communicates with Ovra via MCP at `https://api.getovra.com/api/mcp`
Sandbox keys (`sk_test_*`) are free and have no spending limits. Production keys (`sk_live_*`) require account verification.
External Transmission
Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding
The setup example places the API key directly in an Authorization header configuration, which is standard but sensitive and can lead to secret leakage through logs, screenshots, copied configs, or model-visible context. Because this skill is designed for agentic workflows, any accidental exposure of the bearer token could allow unauthorized payment or account operations against the external service.
Content
Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
The skill explicitly states that all tool calls and receipt uploads are sent to the external endpoint, including base64-encoded documents. This is a meaningful data-exfiltration surface: receipts and invoices can contain names, addresses, tax information, and order details, and an agent may be induced to upload more than intended if controls are weak.
Content
Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
md
### What this skill sends externally
All tool calls (`ovra_pay`, `ovra_card`, etc.) are sent to `https://api.getovra.com/api/mcp` via the MCP protocol. Receipt uploads (`ovra_receipt`) transmit base64-encoded PDF or PNG files (max 5MB) to the same endpoint — only upload invoices/receipts from the current transaction, never arbitrary files. No data is sent to any other external service. All data is stored in the EU (Germany) per GDPR.
## Quick Start — One-Step Payment
External Transmission
Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding
The handle_402 example includes sending a target URL to the payment service, which can disclose what third-party resource the user or agent is attempting to access. While this may be necessary to automate paywall handling, it creates additional exposure of browsing/API targets and purchasing behavior to the external payment provider.
Content
Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
The skill is presented as a payment/checkout helper, but its documented tool surface includes broad administrative capabilities such as agent provisioning, token management, customer data operations, and configuration access. This violates least privilege and creates a risk that an agent invoking the skill for a simple purchase could access or trigger higher-risk account-management actions beyond the user's expectation.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
The document says agents should ask humans before actions like provisioning/deleting agents, freezing cards, or managing keys, yet the same skill exposes tool capabilities that can perform related high-risk account and card operations. This mismatch creates a dangerous trust gap: an orchestrating agent may treat the skill as permitted while the documentation relies only on advisory text rather than enforceable controls.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding
Customer GDPR export/delete and consent-management actions exceed the stated purpose of completing purchases and tracking transactions. These actions can expose sensitive personal data or irreversibly delete account records, so bundling them into a payment skill increases the chance of accidental or prompt-induced misuse.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
78% confidence
Finding
The description presents the skill as "EU-native, GDPR by design," which imposes a locale/regional framing in natural language without offering the user a choice. Although data residency is documented later, the activation description does not clearly state that the skill is intended only for EU-specific use cases or provide user opt-in for this constraint.
