mpp

• Outcome: Review
• Latest audit: Jul 30, 2026 · 5:49 PM UTC
• Version: 0.9.0

Overview

This is a coherent payment-integration skill, but it teaches automatic real-money payment flows and credential handling with several examples that do not put user approval, spend limits, or secret-safety warnings close enough to the risky action.

Install only if you are intentionally building or auditing MPP payment integrations. Treat examples as capable of spending real funds: prefer testnet/sandbox, disable global fetch polyfills unless needed, set per-origin policies and spending limits, protect wallet seeds/private keys/.env files, and require explicit approval before mainnet payments or unattended agent use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill instructs broad activation whenever users mention generic payment-related terms such as 'payment channels', 'paid API endpoints', or 'machine payments'. That can cause the agent to load a payment-capable skill in contexts that are only informational or unrelated to real payment execution, increasing the chance of unnecessary exposure to payment workflows and risky auto-suggested spend behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The client quick-start explicitly states that fetch is polyfilled so payment happens 'transparently' and 'automatically' on a 402 response, but it does not prominently warn that this can trigger real spending. In an agent setting, transparent retry-and-pay behavior is especially dangerous because it can convert ordinary network access into autonomous financial actions without explicit user approval or spend limits.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The examples encourage users to run paid requests and state that payment is handled automatically, but they do not foreground that real funds may be spent depending on account, network, and server challenge. In a payments-focused CLI, omission of an immediate warning near the first examples increases the chance of accidental charges, especially when readers copy-paste commands verbatim.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Documenting `account export` and `account delete` without an adjacent warning can lead users to expose private keys or irreversibly remove wallet material without understanding the consequences. Because this CLI manages payment credentials, mishandling export output or deletion can directly cause asset theft or permanent loss of access.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The client example instructs `payInvoice(invoice)` directly from a server-provided challenge without an explicit warning that this action spends real funds. In a payments SDK context, readers may copy this pattern into production or tests and trigger unintended wallet payments, especially because the surrounding document presents it as a straightforward implementation recipe.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation says the client 'auto-pays' Lightning invoices but does not clearly warn that this triggers real spending of wallet funds. In a payments SDK, readers may copy the example into production or testing environments without realizing requests can immediately authorize Bitcoin payments, increasing the risk of unintended financial loss.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The session section explains that the preimage becomes a bearer token for subsequent requests but does not clearly instruct users to protect it as a secret. Because bearer tokens grant access based solely on possession, logging, storing, or transmitting the preimage insecurely could let an attacker reuse the paid session and consume balance or access paid resources.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The examples use a BIP-39 mnemonic from environment variables without emphasizing that this is wallet seed material that fully controls funds. Developers may mishandle, commit, expose, or reuse these secrets across environments, leading to wallet compromise and irreversible asset loss.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation states that a secret key is automatically generated and persisted to a .env file if missing, but it does not warn users about secure storage, file permissions, secret rotation, or the risk of committing .env files to source control. In a payment SDK context, silently creating persistent credentials increases the chance of accidental disclosure and long-lived secret reuse.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The client integration section tells users to set `maxDeposit`, notes that channels remain open, and says to close explicitly, but it does not clearly foreground the financial risk that funds can remain reserved indefinitely if the server never settles/closes or the client forgets to close. In a payments SDK context, omission of a prominent warning can lead operators or users to lock real funds unexpectedly, especially because this documentation encourages transparent channel reuse across requests and restarts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The recovery section provides ready-to-run instructions for `requestClose` and `withdraw` transactions but does not explicitly warn that these are irreversible on-chain actions that incur fees and can affect fund availability if executed incorrectly or on the wrong network/account. In blockchain payment documentation, operational safety depends on prominent cautions because users may copy-paste transaction code directly into production workflows.

Missing User Warnings

Medium

• Confidence: 71% confidence
• Finding: The CLI example shows commands that can issue a spend request and pay an endpoint, but does not clearly warn that these actions may create real financial obligations if run against live credentials or non-test environments. In a payment-integration skill, copy-pasteable commands materially increase the chance of accidental real charges, especially because the example mentions only briefly adding `--test` rather than making sandbox use mandatory and prominent.

Missing User Warnings

High

• Confidence: 84% confidence
• Finding: The crypto payment setup demonstrates creation of Stripe crypto deposit flows and use of a deposit address without prominently warning that on-chain transfers are generally irreversible and operational mistakes can permanently lose funds. Because this skill is specifically about payment-gated services and machine-to-machine payments, implementers are likely to operationalize examples quickly; in that context, lack of a clear irreversibility warning increases the risk of costly real-world misuse.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation recommends `waitForConfirmation: false` to reduce latency but does not clearly warn that this only provides post-simulation confidence, not final settlement. Integrators may treat a simulated payment as completed and release paid content or services before chain inclusion or finality, enabling loss of goods/service or accounting inconsistencies if the transaction is dropped, replaced, or later fails.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The session flow says the first request automatically opens a payment channel and escrow deposit, but it does not prominently warn that funds become locked until settlement/closure and may remain tied up if the client does not call `close()` or if recovery/cleanup is not implemented. Developers may integrate this as a transparent request flow and inadvertently cause users or agents to over-lock working capital or strand funds in long-lived channels.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation states that `Transport.http()` will automatically extract MCP-over-HTTP payment challenges and retry with a payment credential, but it does not pair that behavior with an explicit warning that the retry can trigger a paid action. In a payments SDK, silent or poorly signposted automatic payment submission can cause unintended charges, especially when used by agents or developers who may assume retries are normal transport behavior rather than billable events.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The WebSocket section describes session-based billing, voucher top-ups, and `stream.charge()` on message handling, but it lacks a clear, explicit warning that charges can continue over the lifetime of the connection. For streaming and interactive agent use cases, this increases the risk of runaway or unexpected spend if the session remains open, loops, or processes more messages than intended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation promotes `polyfill: true` as the default and states that all fetch calls will automatically handle HTTP 402 payment flows, but the example does not prominently warn that this can cause real outgoing paid requests. In a shared process, library, browser app, or agent runtime, globally wrapping `fetch` can make unrelated code paths silently attach payment headers and spend funds when calling payment-enabled endpoints.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `--body` | Request body. In discovery mode, JSON keyed by path is a per-path mapping |
| `--query` | Query parameter `key=value` (repeatable) |
| `--header, -H` | Request header `key:value` (repeatable) |
| `--yes, -y` | Auto-approve mainnet payments |
| `--output-json, -j` | JSON output (auto-enabled in known agent environments) |
| `--verbose, -v` | Verbosity level |

• Confidence: 91% confidence
• Finding: Auto-approve

Credential Access

High

• Category: Privilege Escalation

Content

app = FastAPI()

# Auto-detects realm from env vars
# Auto-generates secret_key to .env if not present
mpp = Mpp.create(
    method=tempo(
        currency="<PATHUSD_TESTNET>",

• Confidence: 95% confidence
• Finding: .env

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:452