ClawHub
Back to skill

Security audit

ROZO Intents Pay & Bridge

Security checks across malware telemetry and agentic risk

Overview

This skill is openly for crypto payments, but it includes an opt-in mode that can move funds without a fresh per-payment confirmation.

Install only if you understand it can create crypto payment intents and help fund irreversible transfers. Keep the confirmation thresholds at 0 unless you intentionally want no-confirmation small payments, and manually verify the recipient address, chain, token, amount, memo, and fee before funding.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The parser explicitly accepts generic EIP-681 native-asset payment URIs by returning parsed results for non-transfer `ethereum:` URIs with a `value` parameter, even though the skill is scoped to stablecoin payments and bridging. In this context, accepting native-asset QR content can cause downstream payment logic or confirmation UX to process ETH/BNB/MATIC-style requests that users did not expect this skill to handle, increasing the chance of unsupported or unintended asset transfers.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
G/C stellar), or a transaction hash. Auto-detects wallet type and
  auto-selects token (USDC preferred).
  Every payment shows full details and waits for an explicit yes/no by
  default. Small-amount auto-execute is opt-in: it runs only if the user
  raises the confirmation thresholds in version.json (shipped 0 = off).
  Do NOT use for general blockchain questions, non-payment tasks, or
  ordinary fiat payments, bank transfers, or bank-account balance questions.
Confidence
88% confidence
Finding
auto-execute

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
filesystem: none — scripts read/write no files; the agent reads
      version.json for confirmation thresholds
    spending: creates Rozo payment intents; every payment prompts for an
      explicit yes/no by default. Auto-execute below user-raised thresholds
      is opt-in via version.json and ships disabled (0/0).
    subprocess: none — scripts run via node with no child processes
---
Confidence
89% confidence
Finding
Auto-execute

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
(Base and Stellar are USDC-only; Solana receives USDC only but can pay in USDT).

**Confirmation:** every payment, any amount, shows full details and waits
for an explicit yes/no. Small-amount auto-execute exists but ships OFF
(thresholds `0` in `version.json`); it runs only if the user raises them.

## Before any payment
Confidence
88% confidence
Finding
auto-execute

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
have the user verify the destination address, chain, token, memo (Stellar)
and amount against a source they trust. A payment to a wrong address, wrong
chain, or without a required memo is not recoverable by Rozo or anyone else. (If the
user has deliberately raised the auto-execute thresholds, their standing
opt-in covers amounts below them — correctness checks still run, but the
per-payment restatement is not required there.)
Confidence
92% confidence
Finding
auto-execute

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
payments or bank transfers. Also handles QR code screenshots containing
  payment URIs (EIP-681, Solana Pay, Stellar URI). Auto-detects wallet
  type, auto-selects token (USDC preferred). Every payment shows full
  details and waits for an explicit yes/no; small-amount auto-execute is
  opt-in and ships disabled (thresholds 0 in version.json).
metadata:
  author: rozo
Confidence
92% confidence
Finding
auto-execute

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
**Every transfer this skill creates is irreversible once funded.** Verify
destination address, chain, token, memo and amount with the user before
funding; a mistake is not recoverable by Rozo. (If the
user has deliberately raised the auto-execute thresholds, their standing
opt-in covers amounts below them — correctness checks still run, but the
per-payment restatement is not required there.)
Confidence
94% confidence
Finding
auto-execute

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Confirmation Thresholds

**Auto-execute is OFF by default.** Both thresholds ship as `0`: every
payment, any amount, gets a full summary and an explicit yes/no. A user who
wants small amounts to run unprompted must raise the thresholds in
`version.json` themselves — that is the opt-in.
Confidence
91% confidence
Finding
Auto-execute

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
Read `version.json` at the plugin root for the current thresholds:

- `freeConfirmThresholdUsd` (default `0` = disabled) — at or below: silent auto-execute
- `singleConfirmThresholdUsd` (default `0` = disabled) — at or below: narrated auto-execute

**Auto-execute is OFF by default.** With the shipped `0`/`0` every payment,
Confidence
93% confidence
Finding
auto-execute

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
Read `version.json` at the plugin root for the current thresholds:

- `freeConfirmThresholdUsd` (default `0` = disabled) — at or below: silent auto-execute
- `singleConfirmThresholdUsd` (default `0` = disabled) — at or below: narrated auto-execute

**Auto-execute is OFF by default.** With the shipped `0`/`0` every payment,
any amount, gets the full summary and an explicit yes/no. Raising the
Confidence
90% confidence
Finding
auto-execute

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- `freeConfirmThresholdUsd` (default `0` = disabled) — at or below: silent auto-execute
- `singleConfirmThresholdUsd` (default `0` = disabled) — at or below: narrated auto-execute

**Auto-execute is OFF by default.** With the shipped `0`/`0` every payment,
any amount, gets the full summary and an explicit yes/no. Raising the
thresholds in `version.json` is the user's deliberate opt-in; never suggest
it, just act on the values found.
Confidence
90% confidence
Finding
Auto-execute

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| Amount               | Confirmation            | Agent narration              | Dryrun fee check            |
|----------------------|-------------------------|------------------------------|-----------------------------|
| `≤ freeConfirm`      | **None** — auto-execute | **Silent** — report only result | **Skip** (fee = 0)       |
| `≤ singleConfirm`    | **None** — auto-execute | **Narrate** steps, no yes/no    | **Skip** (fee = 0)       |
| `> singleConfirm`    | **One** yes/no with full details | Full summary + prompt | **Run** `--dryrun` for exact fee |
Confidence
95% confidence
Finding
auto-execute

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| Amount               | Confirmation            | Agent narration              | Dryrun fee check            |
|----------------------|-------------------------|------------------------------|-----------------------------|
| `≤ freeConfirm`      | **None** — auto-execute | **Silent** — report only result | **Skip** (fee = 0)       |
| `≤ singleConfirm`    | **None** — auto-execute | **Narrate** steps, no yes/no    | **Skip** (fee = 0)       |
| `> singleConfirm`    | **One** yes/no with full details | Full summary + prompt | **Run** `--dryrun` for exact fee |

**Rozo charges no fee for transactions at or below `singleConfirmThresholdUsd`**
Confidence
90% confidence
Finding
auto-execute

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
Read the thresholds from `version.json` (see "Confirmation Thresholds"
above). **They ship as `0`/`0`, so by default NO amount qualifies for the
auto-execute branches below** — every payment takes the confirmation path.
The branches apply only when the user has raised the thresholds themselves.

**If `amount ≤ singleConfirmThresholdUsd`** (only possible after user opt-in):
Confidence
94% confidence
Finding
auto-execute

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.