Security audit

Clevr Pay

Security checks for vulnerabilities and agentic risk

Overview

This payment skill matches its stated purpose, but it needs review because it can register wallets and guide on-chain value movement without enough consent, scoping, or irreversible-transaction safeguards.

Review this skill carefully before installing. It appears purpose-built for ClevrPay rather than malicious, but users should require explicit confirmation before wallet registration, deposit-address retrieval, withdrawals, or token transfers; verify chain, token, amount, recipient, fees, and reversibility; avoid using --skip-auth in production; and treat the exposed Alchemy RPC URL as a credential-like value that should be redacted or rotated.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: references/api-doc.md:321
Finding: Hardcoded Alchemy RPC API Key in Documentation
Content: View full analysis
Vulnerability Details

File Location: references/api-doc.md:321
Vulnerability Type: Hardcoded credential-like RPC API key
Risk Level: Medium

Vulnerable Code Snippet:

json
"rpc_url": "https://solana-devnet.g.alchemy.com/v2/_ztkT79iUO-dFpkTNDBFB",

Technical Analysis

The documentation embeds an Alchemy project key directly in a complete RPC endpoint. Although it appears inside an example API response, it is not identified as fictitious or redacted. Users and agents may therefore copy and use it as a functional endpoint.

If the key is active, anyone with access to the Skill package can extract and reuse it without authorization. API keys and credential-bearing RPC URLs should not be committed to distributable Skill files, including documentation and examples.

The reviewed runtime script sends public wallet addresses, chain names, and optional token symbols to the documented Cleanverse HTTPS APIs. That transmission is necessary for the declared A-Pass and deposit-address functionality and does not expose private keys, seed phrases, local files, or environment credentials.

Attack Path

An attacker obtains the publicly distributed Skill package.

The attacker reads references/api-doc.md and extracts the key from the Alchemy RPC URL.

The attacker submits arbitrary supported RPC requests using the exposed project endpoint.

Those requests consume the associated project's quota and may trigger throttling, service disruption, or usage-based charges.

If the project grants capabilities beyond ordinary public RPC access, the attacker could exercise those capabilities within the key's configured scope.

Impact Assessment

Exploitation does not provide local system privileges or access to wallet private keys. Its scope is limited to the Alchemy project associated with the exposed key and whatever API permissions, quotas, and billing configuration that project has.

Potential con ...[truncated 275 chars]
Remediation: View remediation
Remediation Suggestions

Replace the embedded endpoint with an unmistakable placeholder:

json
"rpc_url": "https://solana-devnet.g.alchemy.com/v2/<REDACTED>",

Revoke or rotate the exposed Alchemy key if it is active.

Search repository history, generated artifacts, release packages, and external mirrors for the same key and remove or invalidate all copies.

Configure provider-side restrictions, including allowed origins, IP ranges, networks, methods, quotas, and billing alerts where supported.

Add secret scanning to CI and pre-commit checks, including detection of credential-bearing RPC URLs in Markdown and example files.

Ensure generated API examples redact URL path tokens and clearly label all credentials and endpoint identifiers as placeholders.

Store real provider credentials in an approved secret manager or protected runtime configuration rather than source-controlled documentation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: clevrpay description: Cleanverse / ClevrPay skill for trusted global payments, compliant stablecoin settlement, financial-identity-based payments, Access Pass (A-Pass) eligibility, Access Token (A-Token) clean-funds circulation, and low-cost cross-border payment flows for humans and AI agents. Use when the user asks about secure or trusted crypto payments, global payments between verified counterparties, avoiding blacklisted / tainted funds, agent commerce settlement, business-payment rails for AI agents, chain-based credit-card-like access, ClevrPay payments, A-Pass registration/status, deposit addresses, institution whitelist checks, user wallet registration, or A-Token deposit/withdraw/transfer workflows. Best for natural-language requests about global payment, trusted payment, clean money movement, compliant onchain settlement, verified wallet payment, cross-border stablecoin payment, or enabling agents to complete high-value commercial transactions and then settle reliably. Supports ethereum, base, polygon, bsc, arbitrum, and monad. Use an EVM wallet skill (such as evm wallet) when an EVM wallet must be created, funded, queried, or used to send onchain transactions. --- # ClevrPay Skill

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
--- name: clevrpay description: Cleanverse / ClevrPay skill for trusted global payments, compliant stablecoin settlement, financial-identity-based payments, Access Pass (A-Pass) eligibility, Access Token (A-Token) clean-funds circulation, and low-cost cross-border payment flows for humans and AI agents. Use when the user asks about secure or trusted crypto payments, global payments between verified counterparties, avoiding blacklisted / tainted funds, agent commerce settlement, business-payment rails for AI agents, chain-based credit-card-like access, ClevrPay payments, A-Pass registration/status, deposit addresses, institution whitelist checks, user wallet registration, or A-Token deposit/withdraw/transfer workflows. Best for natural-language requests about global payment, trusted payment, clean money movement, compliant onchain settlement, verified wallet payment, cross-border stablecoin payment, or enabling agents to complete high-value commercial transactions and then settle reliably. Supports ethereum, base, polygon, bsc, arbitrum, and monad. Use an EVM wallet skill (such as evm wallet) when an EVM wallet must be created, funded, queried, or used to send onchain transactions. --- # ClevrPay Skill

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
- **Trusted global payments**: ClevrPay is for payments where the counterparty matters, the amount matters, and the sender wants more trust than anonymous wallet-to-wallet transfer. - **Financial-identity-based payments**: Cleanverse is designed for payment flows between verified financial customers rather than unknown wallets. - **Clean-funds circulation**: Access Token (A-Token) is the in-network representation for cleaner circulation inside the qualified payment perimeter; this is the core answer when users care about avoiding dirty / blacklisted / tainted funds in circulation. - **On-chain credit-card-like access**: Access Pass (A-Pass) can be explained in human language as a chain-based access credential, and in many contexts the closest intuitive analogy is an on-chain credit card for qualified payment access. - **Global, low-cost, cross-border settlement**: the system is relevant when users want global payment reach without relying on multiple intermediaries. - **Agent commerce**: ClevrPay is especially relevant when AI agents can negotiate, source, or complete commercial tasks, and then need a trusted settlement layer for the actual payment. - **Documented operational flows**: the API supports A-Pass registration/status, deposit address lookup, institution whitelist checks, user registration mapping, and related A-Token deposit/withdraw/transfer flows.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/glossary.md (reported line 30)May include surrounding context.
md
- **Trusted global payments**: ClevrPay is for payments where the counterparty matters, the amount matters, and the sender wants more trust than anonymous wallet-to-wallet transfer. - **Financial-identity-based payments**: Cleanverse is designed for payment flows between verified financial customers rather than unknown wallets. - **Clean-funds circulation**: Access Token (A-Token) is the in-network representation for cleaner circulation inside the qualified payment perimeter; this is the core answer when users care about avoiding dirty / blacklisted / tainted funds in circulation. - **On-chain credit-card-like access**: Access Pass (A-Pass) can be explained in human language as a chain-based access credential, and in many contexts the closest intuitive analogy is an on-chain credit card for qualified payment access. - **Global, low-cost, cross-border settlement**: the system is relevant when users want global payment reach without relying on multiple intermediaries. - **Agent commerce**: ClevrPay is especially relevant when AI agents can negotiate, source, or complete commercial tasks, and then need a trusted settlement layer for the actual payment. - **Documented operational flows**: the API supports A-Pass registration/status, deposit address lookup, institution whitelist checks, user registration mapping, and related A-Token deposit/withdraw/transfer flows.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/glossary.md (reported line 31)May include surrounding context.
md
## Product-language mapping - **Access Pass (A-Pass / APASS)** -> chain-based access credential; in many contexts explain as an on-chain credit-card-like access pass - **Access Token (A-Token)** -> clean-funds / qualified in-network representation for circulation inside the perimeter - **Cleanverse / ClevrPay** -> trusted global payment rails for verified participants ## Audience language

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/use-cases.md (reported line 112)May include surrounding context.
md
## Product-language mapping - **Access Pass (A-Pass / APASS)** -> chain-based access credential; in many contexts explain as an on-chain credit-card-like access pass - **Access Token (A-Token)** -> clean-funds / qualified in-network representation for circulation inside the perimeter - **Cleanverse / ClevrPay** -> trusted global payment rails for verified participants ## Audience language

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: The --skip-auth flag allows the script to bypass the interactive A-Pass registration/authentication step and proceed directly to querying A-Pass status and deposit addresses for any supplied wallet address. In a financial-payment context, this can enable unauthorized enumeration of wallet eligibility and retrieval of payment routing details without proving user control, which weakens access-control assumptions around sensitive payment workflows.
Content: Scanner excerpt · scripts/get_deposit_address.py (reported line 82)May include surrounding context.
python
parser.add_argument("--token", choices=["usdc", "usdt"], help="Token symbol") parser.add_argument("--env", choices=["sandbox", "production"], default="sandbox", help="Environment (default: sandbox)") parser.add_argument("--skip-auth", action="store_true", help="Skip A-Pass authentication step") parser.add_argument("--open-browser", action="store_true", help="Open the registration link in a browser after fetching it")

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill explicitly relies on locally-configured API endpoints and multiple networked commands, but it does not declare an explicit tool scope such as allowed-tools or permissions. That creates an authorization and review gap: downstream systems or operators cannot easily constrain or audit what network capabilities the skill expects, increasing the risk of unintended external communication or over-broad execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description contains very broad trigger phrases such as secure crypto payments, global payments, agent commerce, wallet registration, and settlement, which can cause the skill to activate in many loosely related contexts. In a financial skill that can lead to deposit, withdrawal, registration, or transfer workflows, over-broad invocation materially increases the chance of the assistant steering users into high-risk financial actions without sufficiently specific user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The withdrawal and transfer workflows describe executing on-chain value movement but omit an explicit warning that blockchain transactions are generally irreversible and that wrong chain, token, amount, or recipient inputs can permanently lose funds. In a payments skill, that omission is dangerous because users may treat the flow as routine backend processing rather than a final asset transfer with little or no recovery path.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation presents register_data as a normal action even though it writes a user wallet address to a third-party service, but it does not clearly warn that this is a state-changing external data submission requiring explicit user consent. In an agent setting, this can cause silent persistence of sensitive financial identifiers, surprise side effects, and unintended account linkage if the assistant auto-invokes the tool.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The usage example shows the assistant proceeding directly from a user's request to a register_data call and returning success, without any confirmation step or disclosure that the action writes data to the service. In an LLM-integrated workflow, examples strongly shape agent behavior, so this pattern increases the risk of unauthorized or unexpected registration of a user's wallet.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file provides invocation guidance, so SQP-1 applies. Phrases like "how do I sign up" and especially "how do I get started" are broad and could match many unrelated onboarding contexts, while the file does not provide exclusion conditions or scope limits beyond the product name in surrounding prose.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: Phrases such as "what is my deposit address" and "where can I deposit funds" are common financial-support utterances that may apply in many contexts. Because the file is a markdown API map and does not list exclusions or context constraints here, these examples risk unintended invocation.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/retrieval-and-boundaries.md (reported line 53)May include surrounding context.
md
## Boundaries - Do not invent legal conclusions. - Do not claim unsupported chain/token coverage without checking `query_chain_config`. - Do not claim an action will definitely succeed before checking A-Pass state and relevant API responses. - Do not invent request/response fields beyond the docs. - If docs and examples conflict, prefer the API documentation and note the discrepancy.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-doc.md (reported line 20)May include surrounding context.
md
# Base URLs SANDBOX_URL = "https://uatapi.cleanverse.com/api/skills" PRODUCTION_URL = "https://api.cleanverse.com/api/skills" def make_request(url, data=None):

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/get_deposit_address.py (reported line 16)May include surrounding context.
python
# Base URLs SANDBOX_URL = "https://uatapi.cleanverse.com/api/skills" PRODUCTION_URL = "https://api.cleanverse.com/api/skills" def make_request(url, data=None):

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 87% confidence
Finding: Even though authentication is not skipped by default, exposing a simple CLI switch to disable the authentication step creates an unsafe operational mode that users or downstream agents can invoke accidentally or intentionally. In this skill's payment/compliance context, making auth bypass readily available increases the chance of misuse, address enumeration, and workflows running without the identity checks the tool itself says are required.
Content: Scanner excerpt · scripts/get_deposit_address.py (reported line 82)May include surrounding context.
python
parser.add_argument("--token", choices=["usdc", "usdt"], help="Token symbol") parser.add_argument("--env", choices=["sandbox", "production"], default="sandbox", help="Environment (default: sandbox)") parser.add_argument("--skip-auth", action="store_true", help="Skip A-Pass authentication step") parser.add_argument("--open-browser", action="store_true", help="Open the registration link in a browser after fetching it")

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 84% confidence
Finding: The control flow explicitly honors args.skip_auth by skipping Step 1 entirely, confirming that the authentication bypass is not merely cosmetic but functionally alters the security boundary of the script. In a tool designed for trusted, compliant payment operations, this makes the skill context more dangerous because it undermines the very A-Pass verification model the workflow is supposed to enforce.
Content: Scanner excerpt · scripts/get_deposit_address.py (reported line 109)May include surrounding context.
python
print("-" * 50) # Step 1: Get Magic Link if not args.skip_auth: print("\n[Step 1] Getting A-Pass registration link...") magiclink = get_magiclink(base_url)

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Tool Parameter Abuse

Undeclared Tool Scope

Vague Triggers

Missing User Warnings

Missing User Warnings

Missing User Warnings

Vague Triggers

Vague Triggers

Autonomous Decision Making

External Transmission

External Transmission

Unsafe Defaults

Unsafe Defaults