Payment header deploy check

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:48 PM UTC
• Version: 1.0.0

Overview

The skill’s runtime behavior is mostly read-only and well explained, but its unpinned third-party install command should be reviewed before use.

Review and preferably pin the installer/package/source before running the npx install command. Only use the MCP check for public payment-page URLs you intend to send to PowMCP, and do not treat the header score alone as PCI compliance or authorization evidence without the baseline, diff, review decision, and retained records.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unpinned Third-Party Installation Command Enables Supply-Chain Substitution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 39
Vulnerability Type: Unpinned executable dependency and mutable Skill source
Risk Level: Medium

Vulnerable Code

text

npx skills add powmcp/skills --skill verify-payment-page-header-change-after-deploy

Technical Analysis

The documented installation command invokes the skills npm package through npx without specifying an exact package version. It also identifies the powmcp/skills source without pinning it to an immutable commit, signed release, or integrity hash.

Running an unpinned package through npx can download and execute a newer package version than the one reviewed during this audit. The installed Skill content can likewise change after review because its source is mutable. A compromise, malicious release, dependency-confusion event, or unauthorized upstream modification could therefore cause users to execute installer logic or load Skill instructions that were not included in the audited artifact.

This is a supply-chain exposure rather than evidence that the current package or repository is malicious.

Attack Path

1. An attacker compromises the npm package, its maintainer account, the referenced Skill repository, or another relevant upstream distribution channel.
2. The attacker publishes a modified package version or changes the mutable Skill source.
3. A user follows the documented command after that change.
4. npx retrieves and executes the currently resolved package rather than a specifically audited version.
5. The installer retrieves or installs the attacker-controlled Skill content.
6. Malicious installer code executes with the invoking user's privileges, or altered Skill instructions influence subsequent Agent sessions.

Impact Assessment

Successful exploitation could execute arbitrary code with the permissions of the user running npx. Depending on that user's environment, this may expose accessi ...[truncated 503 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the skills npm package to a reviewed exact version rather than allowing npx to resolve the latest available release.
• Pin the powmcp/skills source to an immutable commit digest or cryptographically signed release.
• Verify package integrity through lockfiles, registry integrity metadata, checksums, or signatures before execution.
• Prefer installing dependencies in a controlled build step and reviewing them before use instead of executing newly downloaded packages directly.
• Use a trusted private registry or an approved dependency proxy where appropriate.
• Run installation with a minimally privileged account in a sandbox that has no production credentials or unnecessary filesystem access.
• Add automated dependency monitoring and require review when either the installer package or Skill source changes.
• Document the exact audited package version, repository commit, and expected integrity value in SKILL.md.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The skill instructs users to install and run an external package via npx skills add powmcp/skills --skill ... without pinning an exact version or immutable reference. That creates a supply-chain risk: future package updates or a compromised upstream release could change what gets executed at install/use time, and this skill is specifically about connecting to an external MCP service, which increases the sensitivity of trust decisions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill enables implicit invocation but does not define clear trigger constraints or activation examples, so the platform may auto-select it in broader situations than intended. Because this skill performs live checks against an external MCP endpoint, unintended invocation could cause unreviewed outbound requests, unnecessary monitoring activity, or evidence generation in contexts where the user did not explicitly ask for it.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest frames the skill as verifying whether live headers changed after deploy or supporting recurring monitoring, while the file states the tool reads only one fetched response and does not determine differences from a baseline. In a PCI/payment-page context, this can mislead users into believing the skill detects unauthorized changes or fulfills monitoring requirements when it only performs a single-point observation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata claims it produces dated evidence for authorization review, but the referenced file explicitly states the tool result does not store a dated artifact, perform a baseline diff, schedule monitoring, or route alerts. This mismatch can cause operators or reviewers to rely on incomplete evidence and mistakenly treat a one-time header snapshot as PCI DSS 11.6.1-compliant change-detection or authorization evidence.

Content

No source excerpt is available for this finding.