Payclaw Io Pub

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:23 AM UTC
• Version: 0.7.1

Overview

This skill is payment-related and clearly describes its purpose, but it runs an unpinned external npm MCP server that can change after review.

Review this carefully before installing. The payment features are disclosed and appear purpose-aligned, but installation depends on the current @payclaw/mcp-server npm release rather than a reviewed, pinned build. Use only in a restricted environment, confirm the npm package provenance, and understand how the Consent Key can be revoked or removed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:10

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–16
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

json

"mcp":
  {
    "name": "payclaw",
    "command": "npx",
    "args": ["-y", "@payclaw/mcp-server"],
    "env": { "PAYCLAW_API_URL": "https://api.payclaw.io" },
  },

Technical Analysis

The Skill launches @payclaw/mcp-server through npx without specifying an exact package version or verifying an integrity hash. As a result, the package version resolved at execution time can differ from the version that was originally reviewed.

The -y option automatically accepts installation prompts, allowing the remotely distributed package to be downloaded and executed without interactive confirmation. Because the MCP server source is not included in the audited project, its effective behavior—including local credential storage, network communication, identity-token processing, and payment-card operations—cannot be verified from this repository.

This creates a third-party software supply-chain boundary in which a compromised npm package, publisher account, or subsequently malicious release can introduce arbitrary executable code.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or another component capable of publishing @payclaw/mcp-server.
2. The attacker publishes a malicious version under the legitimate package name.
3. A user loads or starts the Skill configuration.
4. npx -y @payclaw/mcp-server resolves the unpinned package version and downloads it when necessary.
5. The malicious package executes with the operating-system permissions and environment available to the Agent process.
6. The payload can inspect accessible files and environment variables, intercept PayClaw operations, alter payment requests, misuse locally stored authentication material, or communicate captured data to an attacker-contro ...[truncated 478 chars]

Remediation

View remediation

Remediation Suggestions

• Pin @payclaw/mcp-server to a specific, independently audited version rather than allowing npm to resolve the current release.
• Use a lockfile and verify package integrity against an approved cryptographic hash before execution.
• Remove automatic confirmation through -y where practical, especially for first-time package installation.
• Vendor the reviewed MCP server implementation or include its source in the audited artifact so its authentication, credential-storage, networking, and payment behavior can be examined.
• Monitor the selected package version for ownership changes, unexpected releases, and dependency-chain compromises.
• Run the MCP server in a sandbox with minimal filesystem access, a restricted environment, outbound-network allowlisting, and no access to unrelated credentials.
• Apply an explicit upgrade-review process so package versions change only after source and dependency verification.

T08 · Insecure Dependencies

Error

• Location: payclaw-io/SKILL.md:10

Finding

Duplicate Skill Configuration Executes an Unpinned npm Package

Content

View full analysis

Vulnerability Details

File Location: payclaw-io/SKILL.md, lines 10–16
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

json

"mcp":
  {
    "name": "payclaw",
    "command": "npx",
    "args": ["-y", "@payclaw/mcp-server"],
    "env": { "PAYCLAW_API_URL": "https://api.payclaw.io" },
  },

Technical Analysis

This duplicate Skill definition also invokes @payclaw/mcp-server through npx without an exact version or integrity constraint. The executable dependency can therefore change after the Skill itself has been reviewed.

Automatic approval through -y suppresses installation confirmation. The externally distributed package executes locally even though its implementation is absent from the audited artifact. Consequently, the repository does not provide a verifiable security boundary for the code responsible for authentication, stored Consent Keys, identity credentials, network requests, and virtual-card operations.

Attack Path

1. An attacker gains the ability to publish a malicious release of @payclaw/mcp-server, such as by compromising its npm publisher account or release pipeline.
2. The user starts the MCP server through this Skill configuration.
3. Because no version is pinned, npx resolves the attacker-controlled release.
4. The -y option permits installation and execution without user confirmation.
5. The malicious release runs with the Agent process's permissions.
6. It can intercept or modify payment operations, access locally available authentication material, read other resources available to the process, or exfiltrate information over the network.

Impact Assessment

Exploitation can result in arbitrary code execution under the Agent's operating-system identity. Potentially affected assets include local files, environment variables, MCP request and response data, PayClaw authentication state, identity tokens, and payment workfl ...[truncated 99 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the floating package reference with an exact, reviewed version.
• Enforce lockfile and package-integrity validation before launching the MCP server.
• Avoid non-interactive installation approval for packages that have not already passed verification.
• Include or vendor the executable source so the complete payment and credential-handling implementation can be audited.
• Restrict the process to the minimum necessary filesystem, environment, credential, and network permissions.
• Require security review and explicit approval before updating the pinned package or any transitive dependency.
• Keep this duplicate Skill definition synchronized with the hardened root configuration to prevent the vulnerable invocation from remaining in one copy.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.