PayTrigo (OpenClawBot, Base/USDC)

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:58 AM UTC
• Version: 1.0.0

Overview

This payment skill is broadly coherent, but it ships live payment API keys and can let a bot spend wallet funds with weak safeguards.

Review carefully before installing. Use only a sandbox or limited-balance wallet, avoid passing private keys or passphrases on the command line, do not rely on the embedded PayTrigo keys for production, and require external approval or spend limits before allowing an agent to run the bot payment flow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly states that a platform API key is embedded in a helper script for immediate use. Distributing live credentials inside a reusable skill enables unauthorized invoice creation and abuse of the associated PayTrigo account if the skill is copied, logged, or inspected. In this payment-processing context, embedded credentials are especially dangerous because the skill is meant for broad bot reuse, increasing exposure rather than limiting it.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill is presented as creating or verifying PayTrigo payments, but this code goes further and signs and broadcasts live on-chain approve/pay transactions from a user-controlled wallet. That mismatch is dangerous because a user or orchestrating agent could invoke what appears to be a verification/payment helper and unintentionally authorize token spending and transfer funds.

Description-Behavior Mismatch

Low

• Confidence: 86% confidence
• Finding: The metadata says the skill can verify payments, but the implementation only performs invoice creation, obtains payment intent data, submits a blockchain payment, and polls status. In an agent setting, overstating a safe read-only capability can cause unsafe invocation because callers may expect verification-only behavior while triggering a payment flow instead.

Intent-Code Divergence

Low

• Confidence: 80% confidence
• Finding: The usage text frames the script as a simple `bot` command, but the operational behavior includes decrypting a wallet and submitting live blockchain transactions. This under-disclosure increases the chance that users or autonomous agents will supply secrets and run the command without understanding that it can spend funds.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script embeds a live PayTrigo secret key and always uses it, giving anyone who runs or inspects the skill built-in authority to create or query payment resources against the associated account. In the context of a payment automation skill, this is especially dangerous because it expands access beyond the local operator's intent and enables unauthorized invoice creation, data access, or account abuse without any separate credential provisioning step.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The code and its messaging are inconsistent: user-facing checks suggest the API key should come from PAYTRIGO_API_KEY, but the implementation ignores that and silently falls back to the embedded live secret. This misleads operators into believing authentication is externally controlled when the skill is actually using a privileged baked-in credential, increasing the chance of unnoticed unauthorized payment actions and weakening secret-management expectations.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation promotes no-setup usage with an embedded key and local wallet storage but does not clearly warn that these are sensitive credentials and secret-bearing files. This omission increases the likelihood that operators will treat the materials as ordinary config, commit them to repositories, or leave them accessible on disk. In a payment skill handling API access and encrypted wallet material, lack of explicit warnings materially raises misuse risk.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The bot-payment example instructs users to pass a private key directly on the command line. Command-line secrets are commonly exposed through shell history, process listings, logs, CI output, and telemetry, making wallet compromise likely if the example is followed. Because this skill is designed to perform live payments, exposure of the payer private key can directly lead to theft of funds.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: A live PayTrigo API secret is hard-coded directly in the script, which exposes the credential to anyone with access to the skill and enables unauthorized API use, abuse, or impersonation of the associated account. Because this is a payment-related integration, leaked access can lead to fraudulent invoice creation, operational disruption, or account compromise.

Missing User Warnings

High

• Confidence: 91% confidence
• Finding: The script accepts raw private keys, wallet files, and passphrases, then uses them to sign live transactions, but provides no meaningful trust boundary warning or safety controls. In an agent environment, this is especially dangerous because users may hand over sensitive wallet material to a tool marketed as payment creation/verification, enabling direct fund movement if the script or upstream API behavior is abused.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The script automatically executes approval and payment transactions returned by the remote API without any interactive confirmation, independent validation of the transaction fields, or policy limits on amount/spender. This creates a severe risk: if the API, checkout token flow, or upstream response is compromised or manipulated, the wallet may approve token spending or transfer funds to attacker-controlled addresses.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: A live PayTrigo secret key is hardcoded directly in the script and is then used to authorize real outbound payment API calls. Anyone who can read, copy, or reuse this skill can extract the credential and create or inspect invoices against the linked account, causing financial abuse, account misuse, and secret leakage across every environment where the skill is distributed.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The script performs a real POST to create live invoices without a strong user-facing confirmation, dry-run mode, or explicit warning that the action reaches a production payment service. In an agent skill context, this is especially risky because an automated agent may invoke the flow and trigger external financial operations unexpectedly, exposing users to unauthorized billing attempts or payment workflow abuse.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Allowing passphrases and private keys to be supplied directly via command-line arguments exposes secrets to shell history, process listings, audit logs, and CI job output. In a payment/wallet-management context this is especially dangerous because disclosure of the private key or wallet passphrase can lead to irreversible theft of funds and compromise of all transactions signed by that wallet.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"private": true,
  "type": "module",
  "dependencies": {
    "ethers": "^6.0.0"
  }
}

• Confidence: 91% confidence
• Finding: "ethers": "^6.0.0"

VirusTotal

59/59 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/moltbot-bot-flow.mjs:9

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/moltbot-human-flow.mjs:8

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/paytrigo.mjs:8