Wip Agent Pay Private

• Outcome: Review
• Latest audit: Jul 21, 2026 · 10:43 PM UTC
• Version: 1.0.2

Overview

This payment skill mostly matches its purpose, but it needs review because it can spend money through an agent, use local secret access, and change payment settings with weak scoping.

Install only if you are comfortable giving this skill payment authority and access to a local 1Password-backed worker secret. Require explicit user approval for every payment, use tightly scoped secrets and low-funded wallets, review the hosted worker or self-host it, avoid dormant Privy/user-wallet routes unless intentionally enabled, and do not rely on KV links as globally race-proof single-use payment tokens.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (66)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises network-capable payment behavior but does not explicitly declare permissions, which weakens transparency and any permission-gating a host platform may rely on. In a finance-related skill, undeclared network access is especially risky because it could initiate payment, wallet, or token operations without clear user awareness or policy enforcement.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose understates the actual financial and account-management capabilities, including minting one-time payment URLs, redeeming tokens, viewing balances and transaction history, setting budgets, creating wallets by email, and persisting ledger data. This mismatch is dangerous because users or orchestrators may authorize the skill for simple paywall payments while it actually has broader powers over funds, identities, and financial records.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The code and comments claim token consumption is atomic and race-free, but Cloudflare KV get/delete are separate operations and KV is not suitable for strong atomic read-once guarantees. Concurrent requests can both read the token before deletion propagates, allowing double-consumption of a payment token and undermining one-time payment semantics.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The documentation and comments claim 'atomic delete' and 'no race condition', but the implementation performs a separate KV read followed by a delete. In Cloudflare KV, this is not an atomic compare-and-delete operation, and eventual consistency across edge locations means two consumers can observe the token before deletion propagates, enabling multiple redemptions of a supposedly single-use payment URL.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The notes explicitly acknowledge that custodial Privy payment endpoints will remain in code even though that mode is not intended for launch. Retaining dormant custodial wallet flows increases the chance of accidental exposure, undocumented activation, or incomplete security hardening around key custody and payment authorization paths in a financial system.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The document says the shipped AGENT WALLET mode is CDP-only and non-custodial, while elsewhere stating that Privy custodial endpoints remain in code. This mismatch can cause operators, developers, or auditors to assume only non-custodial behavior exists, leading to misconfiguration, weaker review, or accidental invocation of custodial flows.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The plan materially expands the skill from wallet funding and paywalled-content payments into a partner-commerce marketplace, which increases the agent's authority, payment scope, and operational risk beyond the declared purpose. This kind of scope drift is dangerous because downstream reviewers, users, or policy gates may approve a narrowly described payment skill while the implementation enables broader merchant routing and commerce flows.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The connector marketplace and multi-party settlement model goes well beyond simple wallet funding or paywalled content access, introducing delegated spending, developer payouts, and task-based capture logic. That broader payment orchestration increases attack surface for authorization abuse, billing disputes, and unsafe settlement behavior if consumers or reviewers believe the skill only performs narrow paywall payments.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Merchant onboarding and Stripe connected-account management are privileged platform functions that exceed the stated wallet/paywall purpose and create a higher-risk administrative/payment surface. If exposed under a narrowly described skill, they could be enabled without appropriate scrutiny for KYC, payout routing, account-link generation, or abuse of merchant-management workflows.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: Proposing recurring billing in a skill described as wallet funding and one-off paywalled-content payment adds an undeclared charging capability. Even if only optional and not yet implemented, recurring billing changes the consent model and can lead to unexpected or repeated charges if introduced without explicit scope, disclosure, and controls.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The plan materially expands the skill from simple paywalled-content access into a stored-value wallet and fiat funding system, which changes the trust, compliance, and abuse surface. That expansion is dangerous because it introduces real-money custody, balance accounting, and fund movement behaviors without corresponding controls, user consent language, or operational safeguards in the plan.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The stated security model says only humans fund wallets, but the Stripe flow has code crediting balances or depositing to wallets after payment confirmation. This inconsistency is dangerous because it normalizes automated value creation/movement by the system, creating opportunities for logic flaws, fraudulent credits, replay issues, or mismatches between ledger balances and actual funds.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to generate a Solana keypair and persist the private key to a local file in base64 form. Storing wallet secrets unencrypted on disk creates a durable credential that can be stolen by other local processes, later skills, backups, or logs, enabling unauthorized fund transfers beyond the immediate $0.10 payment use case.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The Monad flow similarly directs the agent to save an EVM private key in plaintext JSON under the working directory. This exposes a reusable signing credential for on-chain assets and authorizations, so compromise of the file can lead to theft or fraudulent payments on the associated account.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The skill metadata says it gives an agent a wallet, funds with Apple Pay, and pays for paywalled content, but the file actually documents paid creation and modification of public pawr.link profiles. This capability mismatch is dangerous because an agent may invoke a skill under false assumptions and trigger on-chain or x402-paid profile mutations the user did not intend.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The provider claims to authorize payment but explicitly skips the fund-transfer step and still mints a real one-time payment URL. This creates a security and integrity flaw: downstream systems or users may rely on a payment artifact that is not backed by an actual transfer, enabling unpaid access, fraudulent workflow completion, or accounting mismatches.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This code invokes a local shell command that reads a token from a user-specific file and uses it to retrieve a secret from 1Password, which exceeds what a user would reasonably expect from a payment skill description. Running local CLI commands and accessing local secret material expands the trust boundary and can expose credentials or create unintended side effects on the host environment.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill reads a local token file and invokes the 1Password CLI to extract a worker secret at runtime, giving the code access to host-level secrets outside the wallet workflow described in the manifest. In an agent-skill context this is dangerous because any code path that can reach this function can use a powerful bearer token to query a remote worker, and the shell-based secret retrieval expands the trusted computing base unnecessarily.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Importing execSync and using it to spawn a shell for credential retrieval gives the skill arbitrary local command-execution capability unrelated to simply paying for content. In a wallet/payment skill this is especially risky because shell execution can be repurposed to access files, invoke other binaries, or pivot into broader host compromise if the skill is modified or inputs later become attacker-controlled.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill spawns a local subprocess to read a token from a local secrets file and then uses that token to retrieve another secret from 1Password. This gives the skill access to host-resident credentials outside the direct payment input/output path, which expands its privilege scope and creates a strong secret-exfiltration risk if the code or upstream worker is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill directly reads a local token file and invokes the 1Password CLI to retrieve a worker secret, giving the skill access to host-side credential material that is not evident from the declared skill description. This expands the skill's authority beyond simply 'paying for paywalled content' into secret retrieval and secret forwarding, which is dangerous because a compromised or modified skill could exfiltrate credentials or reuse them to access other protected services.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill reads a local 1Password service-account token from the user's filesystem and spawns a CLI subprocess to retrieve another secret, granting the code access to credentials unrelated to the immediate Apple Pay checkout UX. This expands trust from a simple funding action into local secret extraction and remote authorization against a worker, creating significant risk if the skill is modified, abused, or run in an unexpected environment.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill reads a local secret from disk and invokes a local CLI to retrieve a credential, then uses that credential to authorize remote payment requests. For a payment helper, accessing local secrets and shelling out expands the trust boundary significantly: a compromised or overly broad skill can trigger spending or expose credential material without clear user consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill markets AI-mediated purchases as frictionless ('you say "let's go"' and 'Done') without prominently warning that real money is being spent or requiring explicit per-transaction confirmation safeguards in the description. In a payment-enabling skill, minimizing user friction without emphasizing consent, spend limits, merchant trust, and transaction review increases the risk of unintended or socially engineered purchases.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly instructs an agent to pull secrets from 1Password, send USDC via Coinbase, and call an external payment relay, but it does not prominently warn that this causes real credential use, outbound network access, and irreversible financial actions. In an agent context, lack of explicit consent and risk framing increases the chance of accidental payments or secret misuse during normal operation.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: cli.js:92

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: providers/coinbase.js:22

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: providers/index.js:20

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: providers/passthrough.js:13

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: providers/privy.js:24

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: providers/stripe.js:28

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: providers/x402.js:24

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: ai/test-skills/Morning-Stew-skill.md:37