ClawHub
Back to skill

Security audit

synaptic-mcp-paywall

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about enabling paid API micropayments, but it asks agents to automatically sign and send payments without stated approval, budget, or recipient controls.

Review this carefully before installing. Only use it with a wallet or account you are willing to risk for automated micropayments, and prefer a configuration that requires explicit approval, strict per-transaction and daily limits, trusted recipient allowlists, and payment logs.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly states that agents will automatically sign and dispatch micro-settlement transactions, but it provides no requirement for user approval, spending limits, recipient validation, or budget controls. In an agent context, this can cause unauthorized or unintended fund transfers to arbitrary paywalled endpoints, especially if a malicious service repeatedly issues 402 challenges or manipulates payment details.

Static analysis

No suspicious patterns detected.