rozo-checkout

• Outcome: Review
• Latest audit: Sep 24, 2026 · 3:25 PM UTC
• Version: 0.1.11

Overview

This is a disclosed crypto checkout skill with optional hot-wallet signing, and the sensitive behavior is purpose-aligned and guarded by confirmation, caps, and local checks.

Install only if you understand it can help move real funds. Use the default keyless path when possible; only enable --send with a dedicated low-balance hot wallet, never a primary wallet, and review the merchant, amount, chain, token, memo, and destination before confirming.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (191)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

UT_EVM_KEYSTORE path"
      - ".git metadata read-only (index, and gitdir/commondir resolution for worktrees), to refuse git-tracked key files"
    spending:
      - "Mode B (--send) signs and broadcasts one ERC-20/SPL transfer, capped at $1,100,"
      - "only after create-order --confirm recorded a digest-bound confirmation."
    subprocess: none
  default_mode_needs_no_credentials: true
---

# Pay a Coinbase Payment Link with Stellar, Solana, BNB Chain, Bitcoin and more

## What this is

A Coinbase Payment Link only accepts **USDC on Base**. This skill lets the
caller pay one with something else:

| You hold | Chain |
|---|---|
| USDT or USDC | Solana, BNB Chain, Ethereum, Polygon |
| USDC | Base, Stellar |
| BTC | Lightning (BOLT11) — any wallet that pays an invoice works, including Cashu/ecash wallets that melt to Lightning |

Native SOL, native BNB, native ETH and on-chain BTC are **not** supported —
always say "USDT **on** Solana", never "SOL".

How it works: the router quot

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · docs/how-it-works.md (reported line 10)May include surrounding context.

works

← back to the README · Quick start · Safety design

Rendering diagram...

The same thing as ASCII, for terminals without mermaid:

text

  Coinbase Payment Link (pl_* / paymentSession_*)
            |
            v
  [ quote-invoice ]  ->  merchant, amount, expiry, short-lived quote receipt
            |
            v
  [ create-invoice ] ->  bridge order:  rozoPaymentId + deposit address
            |                            + exact amount + order expi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The README documents storage of raw Solana/EVM private keys and keystore passphrases in environment variables and a local .env for unattended automation. Even though it warns against this and suggests low-balance hot wallets, env files and process environments are common exfiltration targets for agents, logs, crash reports, shell history, and local compromise, making this a real credential-handling risk.

Content

Scanner excerpt · README.md (reported line 112)May include surrounding context.

md

environment (or a gitignored `.env`) still works for unattended automation.

<details>
<summary><b>Set up a local wallet for <code>--send</code></b> — .env template and per-wallet export steps</summary>

You very likely do not need any of this: the default path needs no key, and for Stellar the `stellar-agent-wallet` skill sends with its own key handling — this `.env` setup is only for unattended EVM/Solana automation with a dedicated low-balance hot wallet.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 149)May include surrounding context.

Then lock it down and keep it out of git:

bash

chmod 600 .env
echo '.env' >> .gitignore

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/QUICKSTART.es.md (reported line 225)May include surrounding context.

Then lock it down and keep it out of git:

bash

chmod 600 .env
echo '.env' >> .gitignore

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/QUICKSTART.es.md (reported line 264)May include surrounding context.

Then lock it down and keep it out of git:

bash

chmod 600 .env
echo '.env' >> .gitignore

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/QUICKSTART.ja.md (reported line 240)May include surrounding context.

Then lock it down and keep it out of git:

bash

chmod 600 .env
echo '.env' >> .gitignore

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/README.es.md (reported line 240)May include surrounding context.

Then lock it down and keep it out of git:

bash

chmod 600 .env
echo '.env' >> .gitignore

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/README.es.md (reported line 279)May include surrounding context.

Then lock it down and keep it out of git:

bash

chmod 600 .env
echo '.env' >> .gitignore

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/README.zh.md (reported line 215)May include surrounding context.

Then lock it down and keep it out of git:

bash

chmod 600 .env
echo '.env' >> .gitignore

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/README.zh.md (reported line 248)May include surrounding context.

Then lock it down and keep it out of git:

bash

chmod 600 .env
echo '.env' >> .gitignore

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 150)May include surrounding context.

bash

chmod 600 .env
echo '.env' >> .gitignore

Solana

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/QUICKSTART.es.md (reported line 265)May include surrounding context.

bash

chmod 600 .env
echo '.env' >> .gitignore

Solana

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/QUICKSTART.ja.md (reported line 241)May include surrounding context.

bash

chmod 600 .env
echo '.env' >> .gitignore

Solana

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/QUICKSTART.md (reported line 256)May include surrounding context.

bash

chmod 600 .env
echo '.env' >> .gitignore

Solana

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/QUICKSTART.zh.md (reported line 220)May include surrounding context.

bash

chmod 600 .env
echo '.env' >> .gitignore

Solana

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/README.es.md (reported line 280)May include surrounding context.

bash

chmod 600 .env
echo '.env' >> .gitignore

Solana

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/README.zh.md (reported line 249)May include surrounding context.

bash

chmod 600 .env
echo '.env' >> .gitignore

Solana

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This finding identifies a real concern in context: the skill supports loading local secret material from .env and key files while also bundling broad wallet capabilities. Even though the document includes safety guidance, combining credential access with general signing primitives can make a payment-specific skill more dangerous if implementation boundaries are weak.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding identifies a real concern in context: the skill supports loading local secret material from .env and key files while also bundling broad wallet capabilities. Even though the document includes safety guidance, combining credential access with general signing primitives can make a payment-specific skill more dangerous if implementation boundaries are weak.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding identifies a real concern in context: the skill supports loading local secret material from .env and key files while also bundling broad wallet capabilities. Even though the document includes safety guidance, combining credential access with general signing primitives can make a payment-specific skill more dangerous if implementation boundaries are weak.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding identifies a real concern in context: the skill supports loading local secret material from .env and key files while also bundling broad wallet capabilities. Even though the document includes safety guidance, combining credential access with general signing primitives can make a payment-specific skill more dangerous if implementation boundaries are weak.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding identifies a real concern in context: the skill supports loading local secret material from .env and key files while also bundling broad wallet capabilities. Even though the document includes safety guidance, combining credential access with general signing primitives can make a payment-specific skill more dangerous if implementation boundaries are weak.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding identifies a real concern in context: the skill supports loading local secret material from .env and key files while also bundling broad wallet capabilities. Even though the document includes safety guidance, combining credential access with general signing primitives can make a payment-specific skill more dangerous if implementation boundaries are weak.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This finding identifies a real concern in context: the skill supports loading local secret material from .env and key files while also bundling broad wallet capabilities. Even though the document includes safety guidance, combining credential access with general signing primitives can make a payment-specific skill more dangerous if implementation boundaries are weak.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/dist/cli.js:19126

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/dist/send-evm.js:10220

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/dist/send-sol.js:9844