AGIRAILS Escrow Payments

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:10 AM UTC
• Version: 3.0.12

Overview

The skill’s payment purpose is clear, but it gives agents real-money wallet authority with under-scoped autonomous payment and installation paths users should review carefully.

Review this skill before installing, especially if you will use mainnet or fund the wallet. Use mock or testnet first, pin package versions, avoid the curl-based remote skill install unless you verify the downloaded content, keep keystore passwords out of general config files when possible, require explicit human approval for mainnet payments, and add allowlists for x402 destinations as well as ACTP providers.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:1117
• Finding: Mutable Remote Agent Skill Installed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:1117-1121` **Vulnerability Type**: Remote instruction payload retrieval **Risk Level**: High ### Vulnerable Code ```bash mkdir -p ~/.claude/skills/agirails curl -sL https://market.agirails.io/skills/claude-code/skill.md \ -o ~/.claude/skills/agirails/skill.md ``` ### Technical Analysis The documented installation procedure downloads a mutable remote Skill file directly into Claude's active Skill directory. It does not pin a version, verify a cryptographic checksum or signature, inspect the retrieved content, or require approval before activation. Although the retrieved file is Markdown rather than a conventional executable, Skill text is an instruction execution channel. Once loaded by an AI agent, its contents can alter tool use, credential handling, payment behavior, and security constraints. The effective payload can therefore change after this repository has been reviewed. The `market.agirails.io` download endpoint is also absent from the external endpoint disclosure at `SKILL.md:1317-1322`. ### Attack Path 1. An attacker compromises `market.agirails.io`, its deployment pipeline, DNS resolution, or the hosted `skill.md`. 2. The attacker replaces the file with instructions that request secrets, invoke tools, alter payment destinations, or weaken safety constraints. 3. A user follows the documented `curl` command. 4. The unverified payload is written into `~/.claude/skills/agirails/skill.md`. 5. Claude loads the Skill during a subsequent invocation. 6. The Agent follows the attacker-controlled instructions with the tools and credentials available to the Agent process. ### Impact Assessment Successful exploitation can provide indirect access to all capabilities exposed to the affected Agent, potentially including: - Reading files accessible to the Agent process. - Accessing wallet configuration or requesting wallet credentials. - Initiating or redirecting USDC transactions. - Executing ...[truncated 253 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bundle the reviewed Skill file within the repository instead of downloading it at installation time. 2. If remote installation is required, use an immutable, versioned artifact URL. 3. Publish and verify a SHA-256 or stronger digest before writing the file into the active Skill directory. 4. Cryptographically sign releases and verify the signature against a pinned public key. 5. Download into a staging directory, display the content or diff, and require explicit user approval before activation. 6. Fail closed if verification fails; do not retain or load the downloaded file. 7. Add `market.agirails.io` and the data it serves to the external endpoint disclosure. 8. Apply restrictive permissions to the installed Skill file and directory. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:178
• Finding: Wallet-Capable Dependencies Are Installed Without Version or Integrity Pinning<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:178-193` **Additional Locations**: `SKILL.md:66`, `SKILL.md:1142`, `README.md:61-62` **Vulnerability Type**: Unpinned third-party executable dependencies **Risk Level**: High ### Vulnerable Code ```bash npm install @agirails/sdk npx actp init -m {{network}} ``` ```bash pip install agirails ``` The n8n integration similarly instructs: ```bash npm install n8n-nodes-actp ``` ### Technical Analysis The project directs users and Agents to install the latest available versions of `@agirails/sdk`, `agirails`, and `n8n-nodes-actp`. No exact versions, lockfile integrity values, package hashes, or signature-verification requirements are provided. These dependencies are security-sensitive because they can: - Create and decrypt wallet keystores. - Access wallet signers in memory. - Construct and submit blockchain transactions. - Run package lifecycle scripts during installation. - Release escrow or perform instant x402 payments. Installing an unpinned package means the code executed by a user may differ from the version reviewed when this Skill was published. A compromised publisher account, registry artifact, transitive dependency, or unexpectedly malicious update could therefore execute in a wallet-enabled environment. ### Attack Path 1. An attacker compromises a package publisher, registry account, release pipeline, or transitive dependency. 2. A malicious package version becomes the registry's latest matching release. 3. A user follows `npm install @agirails/sdk`, `pip install agirails`, or `npm install n8n-nodes-actp`. 4. The package or an installation lifecycle script executes with the invoking user's privileges. 5. At runtime, malicious dependency code gains access to wallet configuration, decrypted signers, transaction parameters, and network connectivity. 6. The package can exfiltrate secrets, redirect payments, or submit unauthorized transactions. ### Impact Assessment The dependency e ...[truncated 620 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin each dependency to an exact reviewed version rather than using the latest release. 2. Commit a lockfile and use `npm ci` for reproducible Node.js installations. 3. Use hash-pinned Python requirements, such as `pip install --require-hashes -r requirements.txt`. 4. Disable unnecessary package lifecycle scripts where feasible, or review them before installation. 5. Pin and audit transitive dependencies using lockfile integrity metadata. 6. Verify package publisher identity, provenance attestations, and release signatures. 7. Treat the n8n community node as a separate high-trust component and review its source before installation. 8. Run wallet-capable dependencies in a least-privileged, isolated environment with limited filesystem and network access. 9. Require human confirmation or hardware-wallet approval for real-money transactions even when SDK code constructs them. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: openclaw/QUICKSTART.md:59
• Finding: Keystore Decryption Password Is Stored in Plaintext Agent Configuration<![CDATA[ ## Vulnerability Details **File Location**: `openclaw/QUICKSTART.md:59-78` **Additional Location**: `SKILL.md:543-545` **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: Medium ### Vulnerable Code ```bash # Generate encrypted keystore (recommended) npx @agirails/sdk init -m testnet # Set password to decrypt keystore at runtime export ACTP_KEY_PASSWORD="your-keystore-password" ``` ```json { "env": { "vars": { "ACTP_KEY_PASSWORD": "your-keystore-password" } } } ``` The SDK auto-detects your wallet: checks `ACTP_PRIVATE_KEY` env var first, then falls back to `.actp/keystore.json` decrypted with `ACTP_KEY_PASSWORD`. ### Technical Analysis The documentation recommends placing the wallet keystore password directly in `openclaw.json`. This is a general configuration file rather than a dedicated secret store. The instructions warn users not to commit the password but do not require restrictive filesystem permissions, secret-manager integration, or separation between the encrypted keystore and its decryption credential. An encrypted keystore protects a wallet only while its password remains confidential. If an attacker can read both the configuration and keystore, the wallet can be decrypted outside the Agent process. Configuration files may also be included in backups, diagnostics, support bundles, or accidental repository commits. Using an exported environment variable has additional exposure risks in process diagnostics, crash reports, child processes, and improperly configured runtime introspection. ### Attack Path 1. A user copies the example and stores the real `ACTP_KEY_PASSWORD` in `openclaw.json`. 2. The configuration is left broadly readable, backed up, included in a support archive, or accidentally committed. 3. An attacker obtains the configuration and the associated `.actp/keystore.json`. 4. The attacker decrypts the keystore using the exposed password. 5. The attacker signs transactions in ...[truncated 532 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not embed `ACTP_KEY_PASSWORD` directly in `openclaw.json`. 2. Integrate with an operating-system keychain, container secret, cloud secret manager, or protected runtime secret provider. 3. If a secret file is unavoidable, store it separately from the keystore and enforce owner-only permissions such as `0600`. 4. Require and verify restrictive permissions on `openclaw.json` and `.actp/keystore.json`. 5. Exclude configuration and wallet files from source control, backups, diagnostics, and support bundles by default. 6. Prevent the secret from being inherited by unrelated child processes. 7. Redact secret values from logs, configuration displays, crash reports, and administrative APIs. 8. Prefer hardware-backed or externally approved signing for mainnet funds. 9. Add credential rotation and wallet-migration guidance for suspected disclosure. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: openclaw/SOUL-agent.md:29
• Finding: Autonomous x402 Payments Bypass the Provider Allowlist<![CDATA[ ## Vulnerability Details **File Location**: `openclaw/SOUL-agent.md:29-33` **Vulnerability Type**: Missing destination authorization for irreversible payments **Risk Level**: High ### Vulnerable Code ```markdown ### Provider Whitelist (Spending) - **ONLY** pay addresses in `providers.json` via ACTP escrow - x402 instant payments to **any HTTPS endpoint** up to MAX_SINGLE_x402 - Unknown ACTP address = **REFUSE** + **ALERT** human ``` The applicable limits are defined earlier in the same file: ```markdown | **MAX_PER_TX** | $50 USDC | REFUSE transaction | | **MAX_DAILY_SPEND** | $200 USDC | REFUSE until tomorrow | | **MIN_BALANCE** | $50 USDC | PAUSE spending, continue earning | | **MAX_SINGLE_x402** | $10 USDC | REFUSE — x402 has no dispute protection | ``` ### Technical Analysis The autonomous Agent applies a recipient allowlist to ACTP escrow payments but explicitly permits x402 payments to any HTTPS endpoint. HTTPS validates encrypted transport and, depending on certificate validation, control of a domain; it does not establish that the recipient is authorized to receive treasury funds. x402 payments are described as final and without dispute protection. Consequently, the exception creates an authorization bypass: an unapproved recipient can receive up to $10 per request and potentially consume the $200 daily allowance without being added to `providers.json`. An Agent can encounter attacker-controlled URLs through user prompts, retrieved web content, API responses, job descriptions, or indirect prompt injection. Merely checking that the destination uses HTTPS does not adequately validate the counterparty, chain, recipient address, amount, or service value. ### Attack Path 1. An attacker supplies content that directs the Agent to an attacker-controlled HTTPS x402 endpoint. 2. The request is framed as a lookup, translation, data extraction, or other simple API call. 3. The Agent selects x402 according to its decision framework. 4. Because x4 ...[truncated 917 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Apply an explicit destination allowlist to both ACTP and x402 payments. 2. Require human approval before the first payment to any new domain, wallet address, or x402 recipient. 3. Bind approved domains to expected wallet addresses, network identifiers, token symbols, and maximum amounts. 4. Validate the x402 challenge independently rather than trusting all headers returned by the endpoint. 5. Reject redirects to unapproved domains and verify the final request destination. 6. Use a substantially lower cumulative x402 budget and rate-limit repeated payments to the same recipient. 7. Require a clear user-visible confirmation showing the domain, wallet address, token, chain, amount, and irreversibility. 8. Treat URLs and payment instructions found in external content as untrusted data, not authorization. 9. Maintain immutable, tamper-evident transaction records and alert on first-time recipients or unusual payment frequency. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/test-purchase.ts:19
• Finding: Test Purchase Utility Can Lock Real Mainnet Funds to an Arbitrary Recipient<![CDATA[ ## Vulnerability Details **File Location**: `scripts/test-purchase.ts:19-70` **Vulnerability Type**: Unsafe mainnet mode and insufficient transaction authorization **Risk Level**: Medium ### Vulnerable Code ```typescript async function main() { console.log('🧪 AGIRAILS Test Purchase\n'); const provider = process.env.PROVIDER_ADDRESS || process.argv[2]; const mode = (process.env.AGIRAILS_MODE as 'mock' | 'testnet' | 'mainnet') || 'testnet'; if (!provider) { console.error('❌ PROVIDER_ADDRESS not set'); console.error(' Set via env var or pass as argument'); process.exit(1); } console.log(`Mode: ${mode}`); console.log(`Provider: ${provider}`); console.log(''); if (mode === 'mainnet') { console.log('⚠️ WARNING: Running on MAINNET with real money!'); console.log(' Press Ctrl+C within 5 seconds to cancel...\n'); await sleep(5000); } try { // SDK auto-detects wallet: .actp/keystore.json → ACTP_PRIVATE_KEY → PRIVATE_KEY const client = await ACTPClient.create({ mode }); const address = await client.getAddress(); console.log(`Requester: ${address}`); // Check balance first const balance = await client.getBalance(address); const formattedBalance = ethers.formatUnits(balance, 6); console.log(`💰 Current balance: $${formattedBalance}`); if (parseFloat(formattedBalance) < 2) { console.error('❌ Insufficient balance for test (need at least $2)'); process.exit(1); } // Create test transaction console.log('\n📝 Creating transaction...'); const txId = await client.standard.createTransaction({ provider, amount: '1', // $1 test deadline: Math.floor(Date.now() / 1000) + 3600, // 1 hour disputeWindow: 300, // 5 min for testing serviceDescription: 'Test purchase - AGIRAILS integration test', }); console.log(` Transaction ID: ${txId}`); console.log(' State: INITIATED'); // Lock escrow console.log( ...[truncated 2161 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Hard-code this test utility to `mock` or `testnet` and reject `mainnet`. 2. If mainnet support is necessary, require a dedicated `--allow-mainnet` flag that cannot be enabled implicitly through the environment. 3. Require affirmative interactive confirmation, such as typing the network, recipient, and amount. 4. Abort mainnet execution when standard input is not an interactive terminal. 5. Validate the recipient with `ethers.isAddress` and normalize it before use. 6. Require the destination to appear in an approved provider allowlist. 7. Display the resolved chain ID, normalized recipient, wallet address, amount, and fee before signing. 8. Add a dry-run mode and make it the default. 9. Require an external signer or human approval for mainnet transaction signatures. 10. Rate-limit or otherwise prevent repeated accidental invocations. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (60)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill description emphasizes escrow and instant payments, but the content also includes wallet discovery, balance checks, and diagnostic/test script patterns unrelated to simple payment execution. That discrepancy can reduce informed consent and cause agents to perform broader local introspection than the user expects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The skill description emphasizes escrow and instant payments, but the content also includes wallet discovery, balance checks, and diagnostic/test script patterns unrelated to simple payment execution. That discrepancy can reduce informed consent and cause agents to perform broader local introspection than the user expects.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- **Gasless transactions** — Smart Wallet (ERC-4337) + Paymaster. Your agent never needs ETH.
- **USDC settlement** — real stablecoin, $1 = $1. On Base L2.
- **Encrypted wallet** — auto-generated keystore (AES-128-CTR, chmod 600, gitignored). No keys in code, ever.
- **Two payment modes** — ACTP escrow for complex jobs. x402 instant for API calls. Same SDK.
- **On-chain identity** — ERC-8004 portable identity + reputation. Follows your agent across marketplaces.
- **Deployment security** — fail-closed key policy, `ACTP_KEYSTORE_BASE64` for containers, `actp deploy:check` secret scanning.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- **Gasless transactions** — Smart Wallet (ERC-4337) + Paymaster. Your agent never needs ETH.
- **USDC settlement** — real stablecoin, $1 = $1. On Base L2.
- **Encrypted wallet** — auto-generated keystore (AES-128-CTR, chmod 600, gitignored). No keys in code, ever.
- **Two payment modes** — ACTP escrow for complex jobs. x402 instant for API calls. Same SDK.
- **On-chain identity** — ERC-8004 portable identity + reputation. Follows your agent across marketplaces.
- **Deployment security** — fail-closed key policy, `ACTP_KEYSTORE_BASE64` for containers, `actp deploy:check` secret scanning.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- **Gasless transactions** — Smart Wallet (ERC-4337) + Paymaster. Your agent never needs ETH.
- **USDC settlement** — real stablecoin, $1 = $1. On Base L2.
- **Encrypted wallet** — auto-generated keystore (AES-128-CTR, chmod 600, gitignored). No keys in code, ever.
- **Two payment modes** — ACTP escrow for complex jobs. x402 instant for API calls. Same SDK.
- **On-chain identity** — ERC-8004 portable identity + reputation. Follows your agent across marketplaces.
- **Deployment security** — fail-closed key policy, `ACTP_KEYSTORE_BASE64` for containers, `actp deploy:check` secret scanning.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- **Gasless transactions** — Smart Wallet (ERC-4337) + Paymaster. Your agent never needs ETH.
- **USDC settlement** — real stablecoin, $1 = $1. On Base L2.
- **Encrypted wallet** — auto-generated keystore (AES-128-CTR, chmod 600, gitignored). No keys in code, ever.
- **Two payment modes** — ACTP escrow for complex jobs. x402 instant for API calls. Same SDK.
- **On-chain identity** — ERC-8004 portable identity + reputation. Follows your agent across marketplaces.
- **Deployment security** — fail-closed key policy, `ACTP_KEYSTORE_BASE64` for containers, `actp deploy:check` secret scanning.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The suggested trigger phrase, `Pay 10 USDC to 0xProviderAddress for translation service`, encourages broad natural-language payment initiation without requiring a strong confirmation or structured authorization step. In an agent setting, similar ordinary user requests could be misinterpreted as approval to transfer funds, increasing the chance of prompt-triggered or socially engineered payments.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README presents easy payment actions and quick-start flows but does not prominently warn that mainnet transfers are real-funds, potentially irreversible operations. In a trustless payment skill, omission of that warning can lead users to test with production money or underestimate the consequences of agent-initiated transfers.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The README instructs users to run `npx actp` without pinning a package version, which causes execution of whatever version is current in the registry at runtime. In a payments skill, this creates a supply-chain risk where a compromised or malicious updated package could exfiltrate wallet material or alter payment behavior during setup.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: This `npx actp` example is also unpinned, so users may execute an unexpected package version fetched at command time. Because the skill manages wallets and payments, a package compromise could directly affect funds, addresses, or secrets during initialization and scaffolding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence
• Finding: `npx ts-node` is unpinned and may execute the latest published binary, introducing a supply-chain path during agent execution. While `ts-node` itself is not payment-specific, in this context it runs code that may access keystores, environment secrets, and payment logic.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The wallet setup command `npx actp init -m testnet` is especially sensitive because it participates in key generation and registration, yet it is not version-pinned. An attacker controlling a future package release or dependency could compromise generated keystores, passwords, or wallet registration flows.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares required environment variables and clearly instructs use of sensitive wallet credentials, but it does not provide an explicit tool/permission scope such as allowed-tools or permissions. In an agent environment, that omission can lead to broader-than-expected access to secrets and shell capabilities when handling payments and keystore operations.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The skill repeatedly invokes `npx actp` without pinning an exact package version, which allows whatever version is current in the registry to be fetched and executed. If the upstream package or dependency chain is compromised, an agent could execute attacker-controlled code during setup or payment operations.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

The SDK ships as **CommonJS**. It works with `require()` and with bundlers (webpack, esbuild, Rollup). ESM projects can import CJS modules via Node.js auto-interop — no extra configuration needed.

This creates `.actp/` config directory. On testnet/mainnet with `wallet: generate`, it also creates an encrypted keystore at `.actp/keystore.json` (chmod 600, gitignored) and registers the agent on-chain via gasless UserOp (Smart Wallet + 1,000 test USDC minted on testnet). On mock, it mints 10,000 test USDC locally.

Set the keystore password (testnet/mainnet only):
```bash

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

}));

  const result = await client.basic.pay({
    to: 'https://api.provider.com/service',  // HTTPS endpoint that returns 402
    amount: '{{budget}}',
  });

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

}));

  const result = await client.basic.pay({
    to: 'https://api.provider.com/service',  // HTTPS endpoint that returns 402
    amount: '{{budget}}',
  });

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

}));

  const result = await client.basic.pay({
    to: 'https://api.provider.com/service',  // HTTPS endpoint that returns 402
    amount: '{{budget}}',
  });

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

}));

  const result = await client.basic.pay({
    to: 'https://api.provider.com/service',  // HTTPS endpoint that returns 402
    amount: '{{budget}}',
  });

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: Using unpinned `npx actp` at this location creates a supply-chain execution risk because the resolved package version may change over time. In a payments skill, that risk is amplified because the executed code may interact with keystores, environment secrets, and blockchain transactions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: This unversioned `npx actp` invocation can execute code fetched at runtime from the package ecosystem with no immutable version constraint. Since the skill manages wallets and payments, compromise of that package path could directly affect funds or secrets.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: `npx ts-node` without a pinned version introduces similar supply-chain risk, though its direct privilege is lower than the payment CLI. It still executes remotely resolved tooling that could run arbitrary code in the user's project context.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: This `npx actp` usage is another instance of unpinned remote code execution from the npm ecosystem. Because it appears in deterministic provider setup instructions, users are likely to copy and run it directly with elevated trust.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The command executes `actp` via `npx` without immutable versioning, exposing users to package substitution or compromise. In the context of keystore initialization and scaffold generation, the impact includes arbitrary local code execution and possible credential exposure.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This `npx ts-node` instruction can cause arbitrary code execution through an unpinned toolchain component resolved at runtime. Although common in docs, it is unsafe guidance in a security-sensitive payment skill.

Static analysis

No suspicious patterns detected.