PayTheFlyPro

• Analyzed: May 12, 2026, 4:18 AM
• Findings: 1
• Version: 1.0.8
• Hash: e30a9f8e1ee0ccacf5ef58b64da0e06d9b5b34bf877e5526cf5511a33893b1a4
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to generate signed crypto payment and withdrawal links, a function that inherently requires handling a private key (`PTF_SIGNER_KEY`). The `SKILL.md` documentation explicitly addresses this high-risk operation with a 'Security Notice,' advising users to use a dedicated, unfunded wallet for signing, which demonstrates an awareness of security and a lack of malicious intent. The code in `scripts/payment.mjs`, `scripts/withdrawal.mjs`, and `scripts/query.mjs` uses standard crypto libraries (`ethers`, `tronweb`) to interact with legitimate blockchain RPCs and the `pro.paythefly.com` service, without any evidence of data exfiltration, unauthorized execution, persistence mechanisms, obfuscation, or prompt injection attempts against the AI agent. All operations are aligned with the stated purpose.