RedotPay Payment Skill for MPP

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:51 AM UTC
• Version: 0.1.7

Overview

This RedotPay skill is mostly clear about paid requests, but it also tells the agent to install and expose a payment CLI in ways users should review first.

Review this before installing. The paid request flow has useful safeguards such as explicit charge confirmation, spend caps, and token handling rules, but do not let an agent run the installer or create the ~/.local/bin symlink unless you trust the RedotPay CLI source and understand the persistent PATH change. Prefer installing the CLI through a trusted, verified process outside the skill, and confirm every charge amount before any redotpay request runs.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:312

Finding

Unverified Remote Installer Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 312–314
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

bash

curl -fsSL "https://raw.githubusercontent.com/redotpay/redotpay-cli/v0.1.1/install.sh" -o redotpay-install.sh
shasum -a 256 -c SHA256SUMS --ignore-missing
bash redotpay-install.sh

Technical Analysis

The installation procedure downloads a shell script from an external GitHub repository and then executes it with bash. Consequently, the code ultimately executed is not contained in the audited Skill and may differ from the content available during review.

The apparent integrity check is ineffective because the audited project does not contain the referenced SHA256SUMS file or an embedded trusted digest for redotpay-install.sh. Moreover, the checksum command and script execution are separate commands: neither && nor an equivalent fail-closed mechanism prevents execution if verification fails. The --ignore-missing option further weakens the intended validation by allowing entries for missing files to be ignored.

This installation behavior is not required merely to document or perform service discovery when a trusted CLI is already available. Automatically retrieving and executing an external installer exceeds the minimum privilege necessary for the Skill's declared search and data-retrieval functionality.

Attack Path

1. An attacker compromises the external repository, the account controlling it, or the referenced installer content.
2. The Agent determines that the redotpay executable is unavailable and follows the Installation Reference.
3. curl retrieves the modified install.sh payload and writes it to redotpay-install.sh.
4. The checksum operation fails or performs no meaningful validation because no trusted project-supplied checksum is available.
5. The following command still executes redotpay-install.sh with the Agent ...[truncated 891 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not automatically download and execute installation scripts as part of the Skill workflow. Require the CLI to be installed separately through an approved, trusted deployment process.
2. Prefer a trusted package registry or bundle a reviewed installer with the Skill so the executed code is included in the audited artifact.
3. If remote retrieval is unavoidable, pin the download to an immutable commit rather than a mutable repository reference.
4. Embed the exact expected SHA-256 digest in the Skill itself and validate the downloaded file directly against that trusted value.
5. Make verification fail closed by chaining successful validation to execution:

bash

curl -fsSL "https://raw.githubusercontent.com/redotpay/redotpay-cli/<immutable-commit>/install.sh" -o redotpay-install.sh
printf '%s  %s\n' '<trusted-sha256>' redotpay-install.sh | shasum -a 256 -c - &&
  bash redotpay-install.sh

6. Download into a securely created temporary directory, reject redirects to unapproved hosts where practical, and remove the installer after use.
7. Display the source, version, expected digest, and intended filesystem changes to the user, then obtain explicit approval before installation.
8. Run installation with the least-privileged account possible and prohibit requests for elevated privileges unless separately justified and approved.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger language is broad enough to activate on ordinary 'find/search/request' phrasing whenever RedotPay is mentioned, increasing the chance the skill runs in contexts the user did not intend. In a payment-capable skill, overbroad activation raises the risk of unnecessary login prompts, environment changes, or progression toward chargeable operations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

L011 says the skill is limited to finding, searching, and requesting only, with 'no purchase/buy flows.' However, later sections explicitly cover quoting cost, obtaining consent, setting spend caps, handling 402 payment behavior, and executing paid redotpay request calls (for example L116-L177 and L267-L285). That is an active contradiction between the stated intent and the documented behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

By instructing creation of a symlink into ~/.local/bin, the skill establishes a durable execution path that survives beyond the immediate task. Persistent agent environment modification increases risk because later workflows may invoke the linked binary automatically without revalidating its provenance.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

Link to Gateway PATH

~/.local/bin is guaranteed to be in the OpenClaw Gateway launchd PATH. If redotpay is installed under ~/.redotpay/bin/ but not found, create the symlink:

bash

ln -sf ~/.redotpay/bin/redotpay ~/.local/bin/redotpay

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

By instructing creation of a symlink into ~/.local/bin, the skill establishes a durable execution path that survives beyond the immediate task. Persistent agent environment modification increases risk because later workflows may invoke the linked binary automatically without revalidating its provenance.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

Link to Gateway PATH

~/.local/bin is guaranteed to be in the OpenClaw Gateway launchd PATH. If redotpay is installed under ~/.redotpay/bin/ but not found, create the symlink:

bash

ln -sf ~/.redotpay/bin/redotpay ~/.local/bin/redotpay

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

L181 states 'Do not run whoami ... during Steps 1, 2, or 3,' but later the document says readiness should be provided only from redotpay wallet whoami (L230) and mandates whoami before any redotpay request (L252), while the initial readiness check also uses whoami as a diagnostic step (L026). These instructions actively conflict about whether whoami is forbidden before Step 4 or required earlier for readiness/preflight decisions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

The instruction to inspect the gateway launch agent plist and PATH is mainly diagnostic and does not itself create persistence. However, in context it supports subsequent environment modification and reveals internal runtime configuration details that are not necessary for normal discovery use.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

md

**Root cause:** `redotpay` binary not found in Gateway PATH.

1. Run `command -v redotpay` in terminal — if found, note the path (typically `~/.redotpay/bin/redotpay`)
2. Check if that directory is in the Gateway launchd PATH: inspect `~/Library/LaunchAgents/ai.openclaw.gateway.plist` → `EnvironmentVariables` → `PATH`
3. If missing, create symlink: `ln -sf ~/.redotpay/bin/redotpay ~/.local/bin/redotpay`
4. Restart Gateway: `openclaw gateway restart`
5. `command -v redotpay` should now succeed in the Gateway context

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The troubleshooting section repeats the symlink persistence behavior, reinforcing a pattern of modifying the gateway environment to make a user-space binary permanently discoverable. Repetition in multiple sections increases the chance an agent treats the change as routine and applies it without adequate review.

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

md

1. Run `command -v redotpay` in terminal — if found, note the path (typically `~/.redotpay/bin/redotpay`)
2. Check if that directory is in the Gateway launchd PATH: inspect `~/Library/LaunchAgents/ai.openclaw.gateway.plist` → `EnvironmentVariables` → `PATH`
3. If missing, create symlink: `ln -sf ~/.redotpay/bin/redotpay ~/.local/bin/redotpay`
4. Restart Gateway: `openclaw gateway restart`
5. `command -v redotpay` should now succeed in the Gateway context

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The installation section instructs downloading and executing a remote script with curl and bash, which is a classic supply-chain and arbitrary code execution risk. Even though the text includes a checksum command, it does not clearly bind the downloaded installer to a verified checksum source or require an explicit safety gate before modifying the system.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill expands from service discovery into local system modification by instructing the agent to create symlinks and alter runtime accessibility of a binary. This broadens the trust boundary from querying a service to changing the local host environment, which can lead to unintended persistence or execution of a user-controlled binary path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The forced symlink command modifies the filesystem and changes which executable the gateway will resolve, without an explicit warning or approval checkpoint. This can create persistent execution of an unexpected binary if the target path is compromised or incorrect.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.