Security audit

AGIRAILS Escrow Payments

Security checks for vulnerabilities and agentic risk

Overview

The skill’s payment purpose is clear, but it gives agents real-money wallet authority with under-scoped autonomous payment and installation paths users should review carefully.

Review this skill before installing, especially if you will use mainnet or fund the wallet. Use mock or testnet first, pin package versions, avoid the curl-based remote skill install unless you verify the downloaded content, keep keystore passwords out of general config files when possible, require explicit human approval for mainnet payments, and add allowlists for x402 destinations as well as ACTP providers.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:1117
Finding: Mutable Remote Agent Skill Installed Without Integrity Verification
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:178
Finding: Wallet-Capable Dependencies Are Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: openclaw/QUICKSTART.md:59
Finding: Keystore Decryption Password Is Stored in Plaintext Agent Configuration
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: openclaw/SOUL-agent.md:29
Finding: Autonomous x402 Payments Bypass the Provider Allowlist
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/test-purchase.ts:19
Finding: Test Purchase Utility Can Lock Real Mainnet Funds to an Arbitrary Recipient
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (60)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill description emphasizes escrow and instant payments, but the content also includes wallet discovery, balance checks, and diagnostic/test script patterns unrelated to simple payment execution. That discrepancy can reduce informed consent and cause agents to perform broader local introspection than the user expects.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill description emphasizes escrow and instant payments, but the content also includes wallet discovery, balance checks, and diagnostic/test script patterns unrelated to simple payment execution. That discrepancy can reduce informed consent and cause agents to perform broader local introspection than the user expects.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 15)May include surrounding context.
md
- **Gasless transactions** — Smart Wallet (ERC-4337) + Paymaster. Your agent never needs ETH. - **USDC settlement** — real stablecoin, $1 = $1. On Base L2. - **Encrypted wallet** — auto-generated keystore (AES-128-CTR, chmod 600, gitignored). No keys in code, ever. - **Two payment modes** — ACTP escrow for complex jobs. x402 instant for API calls. Same SDK. - **On-chain identity** — ERC-8004 portable identity + reputation. Follows your agent across marketplaces. - **Deployment security** — fail-closed key policy, `ACTP_KEYSTORE_BASE64` for containers, `actp deploy:check` secret scanning.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 1329)May include surrounding context.
md
- **Gasless transactions** — Smart Wallet (ERC-4337) + Paymaster. Your agent never needs ETH. - **USDC settlement** — real stablecoin, $1 = $1. On Base L2. - **Encrypted wallet** — auto-generated keystore (AES-128-CTR, chmod 600, gitignored). No keys in code, ever. - **Two payment modes** — ACTP escrow for complex jobs. x402 instant for API calls. Same SDK. - **On-chain identity** — ERC-8004 portable identity + reputation. Follows your agent across marketplaces. - **Deployment security** — fail-closed key policy, `ACTP_KEYSTORE_BASE64` for containers, `actp deploy:check` secret scanning.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 1484)May include surrounding context.
md
- **Gasless transactions** — Smart Wallet (ERC-4337) + Paymaster. Your agent never needs ETH. - **USDC settlement** — real stablecoin, $1 = $1. On Base L2. - **Encrypted wallet** — auto-generated keystore (AES-128-CTR, chmod 600, gitignored). No keys in code, ever. - **Two payment modes** — ACTP escrow for complex jobs. x402 instant for API calls. Same SDK. - **On-chain identity** — ERC-8004 portable identity + reputation. Follows your agent across marketplaces. - **Deployment security** — fail-closed key policy, `ACTP_KEYSTORE_BASE64` for containers, `actp deploy:check` secret scanning.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 1495)May include surrounding context.
md
- **Gasless transactions** — Smart Wallet (ERC-4337) + Paymaster. Your agent never needs ETH. - **USDC settlement** — real stablecoin, $1 = $1. On Base L2. - **Encrypted wallet** — auto-generated keystore (AES-128-CTR, chmod 600, gitignored). No keys in code, ever. - **Two payment modes** — ACTP escrow for complex jobs. x402 instant for API calls. Same SDK. - **On-chain identity** — ERC-8004 portable identity + reputation. Follows your agent across marketplaces. - **Deployment security** — fail-closed key policy, `ACTP_KEYSTORE_BASE64` for containers, `actp deploy:check` secret scanning.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The suggested trigger phrase, Pay 10 USDC to 0xProviderAddress for translation service, encourages broad natural-language payment initiation without requiring a strong confirmation or structured authorization step. In an agent setting, similar ordinary user requests could be misinterpreted as approval to transfer funds, increasing the chance of prompt-triggered or socially engineered payments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README presents easy payment actions and quick-start flows but does not prominently warn that mainnet transfers are real-funds, potentially irreversible operations. In a trustless payment skill, omission of that warning can lead users to test with production money or underestimate the consequences of agent-initiated transfers.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The README instructs users to run npx actp without pinning a package version, which causes execution of whatever version is current in the registry at runtime. In a payments skill, this creates a supply-chain risk where a compromised or malicious updated package could exfiltrate wallet material or alter payment behavior during setup.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This npx actp example is also unpinned, so users may execute an unexpected package version fetched at command time. Because the skill manages wallets and payments, a package compromise could directly affect funds, addresses, or secrets during initialization and scaffolding.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: npx ts-node is unpinned and may execute the latest published binary, introducing a supply-chain path during agent execution. While ts-node itself is not payment-specific, in this context it runs code that may access keystores, environment secrets, and payment logic.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The wallet setup command npx actp init -m testnet is especially sensitive because it participates in key generation and registration, yet it is not version-pinned. An attacker controlling a future package release or dependency could compromise generated keystores, passwords, or wallet registration flows.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares required environment variables and clearly instructs use of sensitive wallet credentials, but it does not provide an explicit tool/permission scope such as allowed-tools or permissions. In an agent environment, that omission can lead to broader-than-expected access to secrets and shell capabilities when handling payments and keystore operations.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The skill repeatedly invokes npx actp without pinning an exact package version, which allows whatever version is current in the registry to be fetched and executed. If the upstream package or dependency chain is compromised, an agent could execute attacker-controlled code during setup or payment operations.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.
The SDK ships as CommonJS. It works with require() and with bundlers (webpack, esbuild, Rollup). ESM projects can import CJS modules via Node.js auto-interop — no extra configuration needed.

This creates .actp/ config directory. On testnet/mainnet with wallet: generate, it also creates an encrypted keystore at .actp/keystore.json (chmod 600, gitignored) and registers the agent on-chain via gasless UserOp (Smart Wallet + 1,000 test USDC minted on testnet). On mock, it mints 10,000 test USDC locally.

Set the keystore password (testnet/mainnet only):

bash

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 337)May include surrounding context.
md
})); const result = await client.basic.pay({ to: 'https://api.provider.com/service', // HTTPS endpoint that returns 402 amount: '{{budget}}', });

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 767)May include surrounding context.
md
})); const result = await client.basic.pay({ to: 'https://api.provider.com/service', // HTTPS endpoint that returns 402 amount: '{{budget}}', });

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 958)May include surrounding context.
md
})); const result = await client.basic.pay({ to: 'https://api.provider.com/service', // HTTPS endpoint that returns 402 amount: '{{budget}}', });

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 993)May include surrounding context.
md
})); const result = await client.basic.pay({ to: 'https://api.provider.com/service', // HTTPS endpoint that returns 402 amount: '{{budget}}', });

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: Using unpinned npx actp at this location creates a supply-chain execution risk because the resolved package version may change over time. In a payments skill, that risk is amplified because the executed code may interact with keystores, environment secrets, and blockchain transactions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This unversioned npx actp invocation can execute code fetched at runtime from the package ecosystem with no immutable version constraint. Since the skill manages wallets and payments, compromise of that package path could directly affect funds or secrets.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: npx ts-node without a pinned version introduces similar supply-chain risk, though its direct privilege is lower than the payment CLI. It still executes remotely resolved tooling that could run arbitrary code in the user's project context.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This npx actp usage is another instance of unpinned remote code execution from the npm ecosystem. Because it appears in deterministic provider setup instructions, users are likely to copy and run it directly with elevated trust.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The command executes actp via npx without immutable versioning, exposing users to package substitution or compromise. In the context of keystore initialization and scaffold generation, the impact includes arbitrary local code execution and possible credential exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This npx ts-node instruction can cause arbitrary code execution through an unpinned toolchain component resolved at runtime. Although common in docs, it is unsafe guidance in a security-sensitive payment skill.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.