T09 · Insecure Skill Coding Practices
Error
- Location
openclaw-skill.js:38- Finding
Configurable API Base URL Enables Credential and Financial Data Exfiltration
- Content
View full analysis
- Remediation
View remediation
Security audit
payrail402
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent spend-tracking purpose, but it can send financial data and credentials to a configurable network endpoint despite documenting a single HTTPS destination.
Review before installing. Use this only if you trust PayRail402 with agent transaction metadata, owner contact details, callback URLs, and PayRail402 credentials. Do not set or accept a custom baseUrl unless you fully control and trust that endpoint, and prefer API-key header authentication over webhook-token URL paths where possible.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
openclaw-skill.js:133- Finding
Webhook Authentication Token Is Exposed in the Request URL Path
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md You can inspect the full implementation in `openclaw-skill.js` — it is 184 lines of plain JavaScript.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill explicitly describes network-capable behavior and handling of sensitive credentials, but it does not declare any explicit tool scope such as allowed network permissions. That weakens least-privilege controls and makes it harder for the hosting platform to constrain or review outbound communication, especially for a skill that transmits financial telemetry and authentication tokens.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The registration handler transmits user-provided fields including contactEmail and callbackUrl to a remote API, but there is no confirmation prompt, user-facing log, or explicit warning at the point of execution. Although the file mentions that network requests go to the PayRail402 API, it does not specifically disclose that personally identifying contact information may be sent during registration.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The inline documentation at L167 says status checks require API key auth sent via the x-agent-key header, while the config comment at L029 describes the key one way and the tracking path at L146 actually sends the same credential in an x-api-key header. This is an active documentation inconsistency about how authentication is performed, which can mislead integrators about the skill's real behavior.
- Content
Static analysis
No suspicious patterns detected.