Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed GStable payment-link lookup tool, with routine npm supply-chain considerations but no hidden or destructive behavior found.
Before installing, understand that payment link IDs or URLs you provide will be sent to the GStable API, or to whatever host is configured in GSTABLE_API_BASE_URL. Prefer the npm run get-link workflow after npm install, keep dependencies updated, and avoid directly executing the npx shebang path unless you trust your npm resolution environment.
The skill declares installation and runtime behavior that uses environment access and outbound network calls, but it does not declare any tool scope or permissions boundary in the manifest. This can cause agents or users to run the skill without clear visibility into its capabilities, weakening least-privilege controls and making unintended data egress more likely.
The shebang uses #!/usr/bin/env npx tsx, which can cause execution through an unpinned package/tool resolution path. If tsx is fetched or resolved from an untrusted or compromised source, arbitrary code could run before the script itself, creating a supply-chain execution risk.
The usage example instructs users to run npx tsx scripts/getPaymentLink.ts <link_id>, which normalizes execution through an unpinned tool. This increases supply-chain exposure because npx may install or resolve a package version at runtime, potentially executing a malicious or unexpected release.
A second example again promotes npx tsx without version pinning, reinforcing an unsafe execution pattern for operators or downstream automation. In a skill intended for assistants and integrations, documentation is effectively part of the attack surface because users may copy-paste commands directly.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The skill is designed to send user-supplied payment link IDs to an external GStable API, but the documentation does not warn users that their input will be transmitted off-platform. Even if the link ID is not highly sensitive by itself, the omission reduces informed consent and can expose user activity or business context to a third party.
The manifest metadata points the homepage to a zh-Hans documentation URL, which hard-codes a Simplified Chinese locale. The file does not indicate that this locale is optional, user-selectable, or required for a region-specific purpose.
The API reference links to a zh-Hans documentation path, which imposes a language choice in the skill documentation. Under SQP-3, forced locale selection is a policy concern unless the file offers a language choice or explains the regional constraint.
The lockfile pins esbuild to 0.27.3, and the referenced advisory indicates a real vulnerability affecting esbuild's development server on Windows, allowing arbitrary file read in that specific mode. In this skill, esbuild appears only as a dev dependency transitively used by tsx, so the issue is real but its exploitability is limited unless developers run the vulnerable dev server workflow on Windows.
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"get-link": "tsx scripts/getPaymentLink.ts"
},
"devDependencies": {
"@types/node": "^20.10.0",
"tsx": "^4.19.0",
"typescript": "^5.3.0"
}
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
},
"devDependencies": {
"@types/node": "^20.10.0",
"tsx": "^4.19.0",
"typescript": "^5.3.0"
}
}
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"devDependencies": {
"@types/node": "^20.10.0",
"tsx": "^4.19.0",
"typescript": "^5.3.0"
}
}
The file’s header points users to a Simplified Chinese documentation path (/zh-Hans/...) as the sole referenced documentation. This can impose a specific language/locale on users without any opt-in or explanation, which matches the language/locale policy concern for natural-language content.
Detected: suspicious.env_credential_access