AGIRAILS Escrow Payments

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 4:13 AM UTC
• Version: 3.0.12

Overview

This is a disclosed real-money blockchain payments skill, so it is not risk-free, but the sensitive wallet, transaction, setup, and logging behavior is aligned with its stated purpose.

Install only if you intend to let an agent handle payments. Start in mock or testnet, use a dedicated low-balance wallet, prefer encrypted keystores over raw private keys, keep provider whitelists and spending limits strict, and review any cron, WhatsApp, IPFS, S3, or external API examples before enabling them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill explicitly requires environment variables such as ACTP_KEY_PASSWORD and describes additional high-sensitivity secrets like ACTP_PRIVATE_KEY, yet the top-level permission model does not clearly declare those capabilities. This creates a transparency and consent gap: an agent or user may activate the skill without understanding that it reads credentials and performs authenticated wallet operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The described purpose is a payment protocol skill, but the content also instructs installation, workspace modification, file generation, config publication, and potentially real on-chain payment actions. This mismatch is dangerous because operators may authorize the skill as documentation/setup assistance while it actually changes local state and can initiate financial transactions, increasing the chance of unintended execution or overbroad trust.

Description-Behavior Mismatch

Medium

• Confidence: 80% confidence
• Finding: This cron example introduces outbound WhatsApp alerting and includes current balance and recent transaction information, expanding the skill from payments into external communications. That creates a real data-exposure risk because financial metadata may be sent to third-party messaging channels without clear consent, access controls, or minimization.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: Weekly automated delivery of treasury summaries to humans over WhatsApp can leak sensitive financial and operational information outside the core payment system. Because the report includes spend, disputes, balance, and runway, compromise of the messaging endpoint or misdelivery could expose business-sensitive treasury data.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: An undeclared WhatsApp messaging capability increases the attack surface by enabling outbound transmission of treasury information to an external service. In a payment-focused skill, undocumented communications features are more dangerous because users may not expect financial data to leave the payment environment.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The explicit `deliver` and `channel: whatsapp` fields operationalize a separate communications function that can exfiltrate treasury summaries to a third-party channel. This is risky because it converts a passive reporting example into an automated outbound data flow involving sensitive payment-related information.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The README encourages a broad natural-language trigger: 'Read SKILL.md and set up AGIRAILS payments'. In an agent context, that can cause autonomous setup of payment capability and wallet initialization without a narrow consent boundary, increasing the chance of unintended activation of financial actions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The example prompt tells the agent to 'Pay 10 USDC' without an adjacent warning that this may transfer real funds on testnet/mainnet. In a payments skill, omission of a prominent real-funds warning can lead users or downstream agents to execute monetary transfers under the mistaken assumption they are still in mock or safe mode.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The phrase 'Pay 10 USDC to 0xProvider for translation service' is a broad natural-language trigger for a money-moving capability. In agent environments, generic payment phrasing can be matched or inferred from ordinary conversation, causing the skill to activate in contexts where the user intended discussion rather than transaction preparation or execution.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The OpenClaw instruction again uses a highly generic natural-language payment phrase as the invocation mechanism. Because this skill can lead to wallet initialization and payment flows, a broad trigger materially raises the risk of unintended activation, prompt-injection chaining, or user confusion about whether they are asking for information or authorizing a transaction.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The example explicitly initializes a mainnet client and notes that credentials are auto-detected from `.actp/keystore.json` or `ACTP_PRIVATE_KEY`, but it provides no warning that running the sample may use real private-key-backed funds on a live network. In a payments skill, this increases the chance that users or agents execute demonstration code against production credentials and unintentionally authorize real transactions or expose sensitive operational setup.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This example performs a real payment flow on mainnet and explicitly locks escrow for 25 USDC, but it does not warn readers that running the snippet can move real funds. In a payment SDK context, copy-paste examples are likely to be executed as-is, so omission of a clear transactional risk warning can lead to unintended asset loss or accidental live transactions.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation states that the client auto-detects .actp/keystore.json or ACTP_PRIVATE_KEY, which normalizes use of sensitive signing material without any adjacent guidance on secure storage, least privilege, or secret handling. In an agent/payment setting, this increases the risk that users expose private keys through environment leakage, unsafe local files, logs, or copied examples.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The standard flow demonstrates releaseEscrow and transition to DISPUTED without warning that these are high-impact state changes that may be irreversible, time-sensitive, or financially consequential. In a trustless payment workflow, users may copy this logic and unintentionally release funds prematurely or trigger disputes incorrectly, causing loss of recourse or operational disruption.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The quickstart explicitly promotes autonomous payments and includes a test purchase flow, but it does not present a prominent upfront warning that these actions can move real funds, trigger irreversible transactions, or create exposure if the agent is misconfigured. In a payments-focused agent skill, burying security notes while emphasizing a '5-minute setup' increases the chance that users enable spending behavior without understanding wallet, whitelist, and runtime prompt risks.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly tells the provider to 'log everything' and store all jobs in local memory files, but it gives no guidance on minimizing, redacting, encrypting, or rotating potentially sensitive job and transaction data. In this payment and service-delivery context, job records may contain customer identifiers, service requests, payment metadata, dispute details, or deliverables, so default plaintext local logging creates unnecessary confidentiality and privacy risk if the host, workspace, or logs are exposed.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The template explicitly suggests storing service outputs in permanent storage such as IPFS, Arweave, S3, or a provider server, but it does not warn implementers that results may contain sensitive user data and that some storage backends are effectively public or immutable. In a payments-for-services agent, providers are likely to process user prompts, documents, or generated outputs, so omitting privacy guidance can lead to unintended long-term disclosure of confidential data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The template tells implementers to send task content to an LLM or external API without warning that request data may be transmitted to third parties for processing, logging, retention, or model training depending on provider settings. Because this skill is for paid agent services, user-supplied content may include proprietary or personal information, making silent third-party disclosure a realistic confidentiality risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The template explicitly documents automatic wallet/private-key discovery from local keystore files and environment variables, but does not pair that behavior with a clear warning about credential sensitivity or least-privilege handling. In an agent/payment context, this can normalize implicit access to signing material and lead developers to run the agent with live keys they did not intend to expose to the skill runtime.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The template shows `linkEscrow`, `releaseEscrow`, and dispute/cancel state transitions as straightforward SDK calls without a prominent warning that these actions lock, release, or otherwise commit user funds. Because this is a payments skill on mainnet by default, developers may copy the example and trigger irreversible financial actions without implementing adequate user consent, validation, or transaction review.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The instruction to persist all jobs to `memory/jobs.jsonl` could cause agents to retain requester-supplied content in plain language, including business data, personal data, API payloads, or dispute evidence. Because this is a merchant/payment skill intended to process arbitrary service requests, the context makes retention risk more credible: users may submit sensitive inputs, and the skill normalizes storing them without safeguards.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.