PayQL

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:46 AM UTC
• Version: 0.1.5

Overview

This skill clearly describes paid data queries, but its default setup runs a mutable npm package with a wallet key that can spend real USDC.

Install only with a dedicated low-balance Base wallet, never a primary or reused private key. Prefer a pinned reviewed package version, a locked local install, your harness's own wallet flow, or a managed wallet with spend caps and allowlists. Review each paid query and keep only the USDC you are willing to spend or lose in the configured wallet.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:29

Finding

Unpinned Runtime Package Executes with Access to a Wallet Private Key

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29-34; also declared in skill.json, line 38
Vulnerability Type: Unpinned third-party dependency with access to sensitive wallet credentials
Risk Level: High

Vulnerable Code

json

{
  "mcpServers": {
    "payql": {
      "command": "npx",
      "args": ["-y", "payql"],
      "env": {
        "PAYQL_NETWORK": "base",
        "PAYQL_PRIVATE_KEY": "0xYOUR_BASE_WALLET_KEY"
      }
    }
  }
}

The same unpinned runtime command is declared in skill.json:

json

"mcp": {
  "tools": [
    "search_subgraphs",
    "get_payment_info",
    "query_subgraph",
    "get_subgraph_schema",
    "wallet_status"
  ],
  "transport": "stdio",
  "endpoint": "npx -y payql"
}

Technical Analysis

The Skill launches payql through npx -y without specifying an exact package version or verifying artifact integrity. Consequently, npm resolves and executes whichever package version is current at installation or invocation time. The -y option automatically accepts installation, eliminating an opportunity for the user to review the resolved package.

The launched process is intentionally given PAYQL_PRIVATE_KEY. This key can authorize EIP-3009 USDC transfers from the associated Base wallet. Any code executed by the package can read the environment variable, transmit the private key to a remote service, sign unauthorized payment authorizations, or otherwise spend funds available to that wallet.

No evidence was found that the currently reviewed documentation itself exfiltrates the private key, and no malicious package implementation was included in the audited project. The vulnerability arises from executing a mutable, externally retrieved dependency with direct access to a spending credential. The documentation's recommendation to use a dedicated low-balance wallet limits potential losses but does not prevent credential co ...[truncated 1930 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace npx -y payql with an exact, reviewed version such as npx --yes payql@<audited-version>, and update it only through an explicit security review process.
2. Prefer installing the dependency ahead of time from a lockfile or immutable artifact rather than downloading executable code when the Skill starts.
3. Verify package integrity using trusted registry metadata, checksums, signatures, provenance attestations, or a controlled internal package mirror.
4. Do not expose the raw wallet private key to the MCP package. Use an isolated signer or managed wallet that keeps the key non-exportable and enforces destination allowlists, approved assets, per-query limits, cumulative spending limits, and expiration.
5. Require explicit user approval before paid operations and verify that each signed authorization matches the displayed network, USDC contract, recipient, amount, nonce, and validity interval.
6. Run the dependency in a sandbox with minimal filesystem and network access. Pass only required environment variables and remove unrelated inherited secrets.
7. Retain the dedicated low-balance wallet guidance, but treat it as defense in depth rather than the primary control.
8. If the existing key may have been exposed to an untrusted package version, stop using it, move remaining assets to a new wallet, and do not replenish the compromised address.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The MCP endpoint executes npx -y payql without pinning a specific package version, so each installation can resolve to whatever version is current in the registry at execution time. That creates a supply-chain risk: a compromised maintainer account, malicious new release, typo/confusion on package resolution, or unexpected breaking update could cause arbitrary code to run on the host when the skill is launched.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.