RedotPay Wallet

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:51 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for RedotPay service discovery and paid requests, but its first-time setup tells users to execute an unaudited remote installer with an ineffective checksum check.

Review the install step carefully before using this skill. Prefer installing redotpay from a trusted, signed release or package manager, verify the exact installer or binary digest independently, and do not run paid requests unless the service, endpoint, price, spend cap, and purpose are clear.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:178

Finding

Unverified Remote Installer Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 178–180
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash

curl -fsSL "https://raw.githubusercontent.com/redotpay/redotpay-cli/v0.1.0/install.sh" -o redotpay-install.sh
shasum -a 256 -c SHA256SUMS --ignore-missing
bash redotpay-install.sh

Technical Analysis

The installation instructions download a shell script from an external, repository-controlled URL and execute it with bash. Consequently, the code ultimately executed is not contained in the audited Skill package and cannot be verified through review of this artifact.

The apparent integrity check does not establish trust in the downloaded installer. SHA256SUMS is neither included in the project nor downloaded by the documented procedure. No expected digest for redotpay-install.sh is embedded in SKILL.md. In addition, --ignore-missing may skip checksum entries whose referenced files are absent. Even if an externally obtained checksum file were available, retrieving it from the same potentially compromised source as the installer would not provide an independent trust boundary.

Referencing the v0.1.0 Git tag does not provide cryptographic immutability. If the repository, hosting account, tag, or delivery path is compromised or altered, the effective installer payload may change after the Skill has been reviewed.

This behavior exceeds the minimum privileges necessary for the declared service-discovery and data-retrieval workflow. Those functions require an available CLI, but they do not inherently require an Agent to execute an unaudited remote shell payload.

Attack Path

1. A user invokes the Skill on a system where the redotpay CLI is unavailable.
2. The Agent or user follows the documented first-time installation procedure.
3. curl retrieves install.sh from the externally controlled repository endpoint.
4. The checksum command fails to ...[truncated 932 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not instruct the Agent to download and execute a mutable remote shell script.
2. Prefer a trusted operating-system package manager or reputable package registry with signed, versioned releases and reproducible provenance.
3. If a standalone installer is unavoidable, reference an immutable release artifact and place its exact SHA-256 digest directly in the audited Skill documentation.
4. Verify the specific installer before execution and terminate immediately on a mismatch. Do not use --ignore-missing.
5. Obtain signatures or checksums through an independent trusted channel rather than from the same location as the payload.
6. Vendor the reviewed installer into the Skill package where policy permits, allowing its contents to be audited together with the instructions.
7. Run installation with the least-privileged account required. Do not request administrator or root privileges unless a documented component strictly requires them.
8. Make installation an explicit user-controlled action rather than an automatic consequence of invoking the Skill.
9. After installation, verify the CLI version and, where supported, its package signature or binary digest before using it with wallet credentials.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description and trigger guidance are broad enough to match many ordinary 'find/search/request' prompts, which can cause this payment-capable skill to activate in contexts where the user may only want general information. Because the skill can progress toward authenticated, chargeable requests, over-triggering increases the risk of unintended service discovery, payment workflow initiation, and user confusion around consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.