T09 · Insecure Skill Coding Practices
Error
- Location
scripts/paypol-discover.sh:21- Finding
API Credentials and Financial Instructions Can Be Sent to an Untrusted or Plaintext Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
PayPol Agent Marketplace
Security checks for vulnerabilities and agentic risk
Overview
This skill is openly for PayPol marketplace blockchain agents, but it enables broad real financial actions through free-form remote requests without enough endpoint, privacy, or confirmation controls.
Review this carefully before installing. Use only a tightly scoped PayPol API key with spending and agent limits, verify PAYPOL_AGENT_API is the intended trusted HTTPS endpoint, avoid putting secrets in prompts, and require human review before any transaction, approval, sweep, deployment, escrow release, or payroll action.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:12- Finding
Unused Unpinned Axios Dependency Introduces Avoidable Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description presents the skill as an execution-oriented capability for hiring marketplace agents and carrying out substantive on-chain operations. However, the code only performs read-only discovery of available agents via an HTTP API call to /marketplace/agents and formats the results for display. There is no logic for hiring an agent, submitting prompts, interacting with Tempo L1, invoking wallets/contracts, or performing any payment/escrow/stream/token/batch transaction functionality. This is a material mismatch in primary purpose and capabilities.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The inclusion of a 'wallet-sweeper' agent is highly destructive because it is designed to move all token balances to another wallet, yet the skill provides no prominent safety warning or execution constraints around it. In an LLM-driven workflow, this capability materially raises the risk of catastrophic asset loss from prompt injection, misunderstanding, or misuse.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The webhook section states that PayPol forwards job data including the user's prompt, wallet identifier, budget, and deadline to developer-hosted third-party webhooks, but it omits any warning or consent guidance. Because this marketplace coordinates external agents and real financial workflows, undisclosed forwarding of user task data to arbitrary community agent operators materially increases privacy, confidentiality, and targeting risks.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The skill exposes shell-based network execution but does not declare any explicit tool scope such as permissions or allowed-tools. This makes the operational boundary unclear and increases the chance that an agent can invoke networked shell commands capable of triggering real on-chain actions without adequate policy enforcement.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill prominently advertises real escrow, payment, deployment, and transfer capabilities but does not provide a strong upfront warning that actions may move funds or create irreversible on-chain transactions. In an agent setting, missing transaction-risk warnings can cause users or orchestrators to trigger destructive financial actions without appreciating the consequences.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The skill sends user-supplied prompts and an API key to an external service, which then performs real blockchain-related actions. This is dangerous because sensitive intent and potentially financial instructions are transmitted off-platform to a third party, and the remote service can translate natural-language prompts into irreversible on-chain operations.
- Content
Step 2: Execute an agent job
bash curl -s -X POST "${PAYPOL_AGENT_API:-https://paypol.xyz}/agents/{AGENT_ID}/execute" \ -H "Content-Type: application/json" \ -H "X-API-Key: $PAYPOL_API_KEY" \ -d '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example explicitly describes real on-chain escrow creation, fund locking, and payment release as an expected outcome, but it does not include a clear warning that these actions are financially impactful and may be irreversible once executed. In a skill designed to hire agents and perform smart contract operations, example commands can be treated as copy-paste-ready instructions, which increases the chance of accidental fund movement by users who assume the workflow is only illustrative.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example walks a user through token deployment, approval, and batch distribution of assets on-chain but does not include any warning that these actions are real, irreversible transactions that can spend funds or create persistent approvals. In a skill specifically designed for smart contract execution, omission of transaction-risk warnings increases the chance that a user authorizes unintended approvals or distributions without understanding the consequences.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The execute endpoint documentation asks callers to submit a free-form prompt and wallet identifier to a remote service, but it does not warn that sensitive task content is transmitted off-box to PayPol infrastructure for processing. In a skill that triggers real on-chain operations, users may include secrets, financial details, or operational instructions, so the omission creates a meaningful privacy and data-handling risk through uninformed disclosure.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
This script performs an external POST request to a remote service and includes both the API key in a header and user-controlled prompt/wallet data in the request body. External transmission is core to the tool's purpose, but it still represents a real security boundary crossing: sensitive prompts, wallet identifiers, and authorization material depend on the trustworthiness of the configured endpoint and the user's awareness of what leaves the system.
- Content
sh fi # ── Execute ─────────────────────────────────────────────────── RESPONSE=$(curl -s --max-time "$TIMEOUT" \ -X POST "${API_BASE}/agents/${AGENT_ID}/execute" \ -H "Content-Type: application/json" \ -H "X-API-Key: ${API_KEY}" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script transmits the user-supplied prompt and wallet identifier to a remote PayPol API, but it does not provide any explicit warning, consent prompt, or redaction guidance before sending potentially sensitive operational data off-host. In the context of a blockchain/agent hiring tool, prompts may contain addresses, payment instructions, or business-sensitive details, so silent transmission increases privacy and operational risk even if the network call is expected.
- Content
Static analysis
No suspicious patterns detected.