Security audit

spraay-gateway

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed connector to an external paid payment gateway and includes clear human-confirmation safeguards for money-moving actions.

Install only if you intend to use Spraay's external gateway. Treat this as a financial tool: review every dry run and fee estimate, confirm each spend explicitly, keep SPRAAY_API_KEY private, and do not set SPRAAY_GATEWAY_URL to an untrusted host.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This is a mismatch because the declared description presents a full-featured payment gateway integration for operational payment actions and broad endpoint access, while the actual code is a narrow access-check utility. It performs only two GET requests to the Spraay Gateway: one unauthenticated reachability check and one authenticated usage check if an API key is present. Although chain-status is mentioned in the description, the code does not implement the larger claimed capabilities, so the skill's primary purpose differs materially from the declared purpose.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The manifest description says to use the skill whenever the user wants to "interact with any Spraay Gateway endpoint," alongside a very wide set of payment, pricing, and chain-status tasks. This broad activation language lacks clear scope boundaries or exclusions, which increases the chance of unintended invocation for generic crypto- or payment-related requests.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: ## Human approval rules (non-negotiable) - **Never initiate any payment, subscription, or checkout autonomously.** Subscribing is a human-in-browser action. x402 per-call payments require the user's explicit "yes" for each spend, with the amount stated. - **Any endpoint that moves funds** (`/api/v1/batch/execute`, `/api/v1/escrow/create`, payroll runs, robot task dispatch) requires: (a) a prior dry run via `POST /free/validate-batch` and `GET /free/estimate-batch`, (b) a plain-language preview shown to the user — recipient count, total amount, token, chain, estimated fees — and (c) the user's explicit confirmation of that exact preview. No confirmation, no execution. - Never request, read, or handle private keys or seed phrases. Signing happens in the user's own wallet tooling. ## Endpoint reference
Confidence: 75% confidence
Finding: No confirmation

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

Category: YARA Match
Content: # Spraay Gateway Spraay is a multi-chain x402 payment gateway. Its core capability is **batch payments**: pay up to 200 recipients in a single transaction with roughly 80% gas savings versus individual transfers. Around that core it exposes 190 endpoints (32 free, 150+ paid) across 37 categories on 15 mainnet chains (Base, Solana, Ethereum, Polygon, Arbitrum, XRP Ledger, Stellar, Bitcoin, Stacks, and more) — escrow, crypto payroll, robot task payments (RTP), GPU/compute, token data, and research. Provenance: the Spraay payment toolset (batch, escrow, RTP) is merged into NVIDIA's NeMo-Agent-Toolkit-Examples (#27), ships as a community integration on the official Strands Agents documentation site (strandsagents.com/docs/integrations/tools/strands-spraay), and is merged into google/adk-python-community (#95) and aaif-goose/goose (#7525). Those projects are not affiliated with or endorsing Spraay; the citations describe where the tooling has been merged.
Confidence: 80% confidence
Finding: pay up to 200 recipients in a single transaction with roughly 80% gas savings versus individual transfers. Around that core it exposes 190 endpoints (32 free, 150+ paid) across 37 categories on 15 mai

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.