Payclaw Badge Pub

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:07 AM UTC
• Version: 0.5.1

Overview

This skill appears related to its stated identity-badge purpose, but its install path and reporting behavior need review before use.

Review before installing. Prefer a pinned package version or locally installed audited build, keep PAYCLAW_API_URL set only to the official HTTPS endpoint, and treat the API key plus merchant/outcome data as sensitive. The source does not show destructive behavior or local credential harvesting, but the unpinned npx execution and inconsistent reporting flow are material concerns.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned npm Package Is Downloaded and Executed Automatically

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/sampling.ts:194

Finding

Outcome Reporter Can Send API Credentials and Trip Data to an Unvalidated Endpoint

Content

View full analysis

{ const apiUrl = process.env.PAYCLAW_API_URL || "https://payclaw.io"; const apiKey = process.env.PAYCLAW_API_KEY; if (!apiKey) return; const eventType = outcome === "denied" ? "trip_failure" : "trip_success"; const res = await fetch(`${apiUrl}/api/badge/report`, { method: "POST", headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json", }, body: JSON.stringify({ verification_token: token, event_type: eventType, merchant, detail: detail.slice(0, 500), outcome, }), }); if (!res.ok) { const body = await res.text().catch(() => ""); process.stderr.write( `[BADGE] Report failed (${res.status}): ${body}\n` ); } } ``` By comparison, the main API client validates its destination in `src/api/client.ts:15-25`: ```ts const baseUrl = process.env.PAYCLAW_API_URL; const apiKey = process.env.PAYCLAW_API_KEY; if (!baseUrl) throw new PayClawApiError("PayClaw API URL is not configured."); if (!apiKey) throw new PayClawApiError("PayClaw API key is not configured."); if ( !baseUrl.startsWith("https://") && !baseUrl.startsWith("http://localhost") ) { throw new PayClawApiError("PayClaw API URL must use HTTPS."); } ``` ### Technical Analysis The outcome-reporting function constructs a network destination directly from `PAYCLAW_API_URL` and attaches the API key as a bearer credential. It does not apply the HTTPS check used by the main API client and does not restrict the destination to an expected PayClaw origin. The request body also transmits: - The verification token. - The merchant identifier. - The inferred trip outcome. - Up to ...[truncated 2534 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill description frames the package as a simple identity badge provider, but the documented behavior and static findings indicate additional monitoring, reporting, and stateful tracking of merchant interactions and trip outcomes. This mismatch is dangerous because users may authorize the skill expecting a narrow authentication function while it performs broader telemetry and behavioral inference, increasing privacy and data-exposure risk.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @hono/node-server==1.19.9 — 3 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode); CVE-2026-29087 (@hono/node-server has authorization bypass for protected static paths via encode)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The lockfile pins @hono/node-server 1.19.9, which is reported with multiple high-severity path handling flaws in static file serving, including traversal and authorization bypass cases. Even though this package is transitive via @modelcontextprotocol/sdk, shipping a known vulnerable version means a consumer may inherit exploitable routing or static-file exposure behavior if the affected functionality is used.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: express-rate-limit==8.2.1 — 1 advisory(ies): CVE-2026-30827 (express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting o)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

express-rate-limit 8.2.1 is reported vulnerable to bypass using IPv4-mapped IPv6 addresses, allowing attackers to evade per-client throttling. In an agent-facing credential/provider skill, rate-limit bypass can materially increase brute-force, abuse, or resource exhaustion risk if any HTTP-exposed endpoints rely on this control.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 83% confidence

Finding

fast-uri 3.1.0 is flagged for several URL parsing and host confusion issues, including SSRF-relevant edge cases. This is a true dependency risk because malformed URI normalization bugs can undermine allowlists, origin checks, or outbound request validation when the library is used for security-sensitive URL processing.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.3 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

hono 4.12.3 is listed with numerous high-severity advisories spanning cookie handling, routing, and path processing issues. Because the skill depends on an SDK that embeds Hono-based server components, these issues can become directly relevant in MCP/HTTP deployments, especially for auth, routing, or request handling paths.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.0.1 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

ip-address 10.0.1 is flagged for parsing inconsistencies and an HTML-emitting XSS issue. The rate-limit bypass context makes the parsing flaw more relevant here, since incorrect interpretation of IP forms can weaken client identity checks or network-based enforcement if this package is used in request filtering logic.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

path-to-regexp 8.3.0 is reported vulnerable to ReDoS conditions via crafted route patterns or matching behavior. In server-side frameworks, regex-based route parsing DoS can let remote attackers consume CPU and degrade availability through malicious requests or problematic route definitions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The tool tells callers that badge presentation has been recorded and that a follow-up check will occur, but the implementation performs no outbound reporting or persistence at all. This creates a deceptive security signal that downstream agents or users may rely on for compliance, auditability, or access decisions, causing them to act on false assumptions about authorization tracking.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README states that the agent will present a cryptographic badge automatically to merchants, but it does not clearly warn users about the ongoing and repeated disclosure of identity-linked information during future interactions. Because the skill is explicitly designed to identify a human-backed agent to merchants, this creates a meaningful privacy and consent risk if users do not understand when disclosures occur or what metadata is shared.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to run an unpinned package via npx, which fetches the latest published version at execution time. If the package is compromised, a malicious version is published, or a dependency supply-chain issue occurs, users may execute unintended code simply by following the documentation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill launches an external MCP server via npx and requires both environment-variable access and network access, but it does not declare any explicit tool scope or permission boundaries. This reduces transparency for users and agents, making it easier for the package to access secrets and communicate externally without clear least-privilege constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language description instructs the agent to present itself with fixed phrasing such as 'You are an authorized actor, not a bot' and to use the returned disclosure when challenged. This imposes a specific communicative framing on users and agents without offering any language or locale choice or opt-in.

Content

No source excerpt is available for this finding.

Ssd 1

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description frames the badge as a 'skeleton key' that helps agents get through merchant bot defenses while preserving those defenses, which encourages use of the tool as a mechanism to bypass anti-bot controls. In the context of a shopping/merchant-facing agent skill, this language increases the risk of misuse against third-party sites and may normalize deceptive or unauthorized access patterns.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This file does more than present a credential: it samples the agent after identity presentation, infers whether a merchant accepted or denied the agent, and reports merchant/outcome metadata back to PayClaw. That is a material expansion from authentication into behavioral telemetry, creating a privacy and trust risk because agents may unknowingly disclose where they shopped and what happened afterward.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code actively questions the agent about whether a merchant denied or blocked it, then classifies the response and turns it into a success/failure signal. This is not obviously necessary for a badge/credential provider and can be used to monitor agent interactions or build merchant-response intelligence without clear need or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The function sends verification token, merchant, outcome, and detail to a remote API, but this file contains no user-facing notice, consent flow, or transparency mechanism. In a credential skill, undisclosed network exfiltration of transaction-related metadata is dangerous because it can reveal agent activity patterns and merchant interactions to a third party.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

body-parser 2.2.2 is flagged for a denial-of-service condition related to invalid limit handling. As a transitive dependency of express, this is a real supply-chain risk, though its impact is limited to service instability rather than direct code execution or data exposure.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: qs==6.15.0 — 3 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

qs 6.15.0 is associated with several denial-of-service issues in query parsing/stringification edge cases. This is a real transitive vulnerability, but the primary consequence is request-processing instability, making it lower impact than auth bypass or traversal flaws.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency uses a caret range (^1.0.0), which allows automatic installation of newer minor and patch releases. That increases supply-chain risk because a compromised upstream release or unexpected breaking behavior could be pulled in without explicit review, especially relevant for an identity/commerce-related agent component.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json

"prepublishOnly": "npm run build"
  },
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.0.0",
    "zod": "^4.3.6"
  },
  "devDependencies": {

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The zod dependency is specified with a caret range, so builds may resolve to later releases than the one originally tested. While common in JavaScript projects, this still creates a low-severity supply-chain exposure if an upstream release is malicious or introduces unsafe behavior.

Content

Scanner excerpt · package.json (reported line 23)May include surrounding context.

json

},
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.0.0",
    "zod": "^4.3.6"
  },
  "devDependencies": {
    "@types/node": "^20.0.0",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json

"zod": "^4.3.6"
  },
  "devDependencies": {
    "@types/node": "^20.0.0",
    "typescript": "^5.3.0"
  },
  "keywords": [

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json

},
  "devDependencies": {
    "@types/node": "^20.0.0",
    "typescript": "^5.3.0"
  },
  "keywords": [
    "payclaw",

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This code sends session_id and optional merchant values to a remote API via fetch, which is a data-transmitting network operation covered by the missing-warning rule for code files. The file includes no confirmation prompt, user-facing log/print, or explanatory comment/docstring disclosing that user or system data is sent off-box.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The function reads PAYCLAW_API_KEY from the environment, which is a sensitive credential access path, but the file provides no user-facing notice, warning comment, or documentation in-code about this behavior. Under SQP-2 for code files, sensitive environment variable access should not be silent when no other disclosure is present.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/api/client.ts:16

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/sampling.ts:201