Security audit

AgentPay MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill is clearly meant for agent-driven crypto payments, but it asks users to install an unpinned global package and place a wallet private key in persistent MCP config, which creates serious asset-loss risk.

Review carefully before installing. Only use a dedicated low-balance wallet, never a primary wallet or treasury key, and prefer a safer secret mechanism or isolated runtime. Pin and verify the npm package before giving it any funded key, and keep transaction limits very low with human approval for larger payments, bridging, or unfamiliar recipients.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:38
Finding: Unpinned Global Installation of an Unreviewable Third-Party Payment Package## Vulnerability Details **File Location**: `SKILL.md`, lines 38-41 **Vulnerability Type**: Supply-chain exposure through an unpinned global npm dependency **Risk Level**: High **Vulnerable Code**: ```markdown ## Installation ```bash npm install -g agentpay-mcp ``` ``` ### Technical Analysis The Skill instructs users to globally install `agentpay-mcp` without an exact version, integrity digest, lockfile, or locally reviewable implementation. Consequently, the installed artifact may change after this Skill has been audited. The repository contains only `SKILL.md`, so the executable package's install scripts, private-key handling, transaction validation, spending-limit enforcement, and network behavior cannot be verified from the audited project. A global installation has greater scope than a project-local dependency and may execute npm lifecycle scripts during installation. The GitHub URL documented elsewhere in the file does not cryptographically establish that the npm artifact is built from the referenced source. ### Attack Path 1. An attacker compromises the npm publisher account or causes a malicious package version to be distributed. 2. A user follows the Skill instructions and runs `npm install -g agentpay-mcp`. 3. Malicious lifecycle code may execute during installation, or the compromised MCP executable runs when the agent starts it. 4. The MCP process receives `AGENT_PRIVATE_KEY` through its environment. 5. The package exfiltrates the key, signs unauthorized transactions, or substitutes attacker-controlled payment behavior. ### Impact Assessment Successful exploitation could execute code with the privileges of the installing or running user. Because the package is subsequently supplied with a cryptocurrency private key, compromise could also expose durable wallet signing authority and result in irreversible asset loss. Any MCP-level spending limits may be bypassed if an attacker obtains the raw key and ...[truncated 31 chars]
Remediation: ## Remediation Suggestions - Pin the package to an exact, reviewed version rather than installing the latest available release. - Verify the npm artifact using an integrity digest and npm provenance or equivalent signed build attestations. - Include or reference auditable source tied cryptographically to the distributed package. - Prefer a lockfile-backed, project-local installation over a global installation. - Disable npm lifecycle scripts where compatible with the package's legitimate installation requirements. - Review all install scripts, runtime network destinations, transaction-building logic, and secret-handling behavior before supplying a funded wallet key. - Run the MCP server in a restricted account or sandbox with minimal filesystem and network access. - Use a dedicated, low-balance wallet and an independently enforced transaction policy so package compromise cannot expose unrelated assets.

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:45
Finding: Cryptocurrency Private Key Stored in Plaintext MCP Configuration## Vulnerability Details **File Location**: `SKILL.md`, lines 45-57 **Vulnerability Type**: Persistent plaintext storage of wallet signing credentials **Risk Level**: High **Vulnerable Code**: ```markdown Add to your MCP config (`~/.config/claude/mcp.json` or equivalent): ```json { "mcpServers": { "agentpay": { "command": "agentpay-mcp", "env": { "AGENT_PRIVATE_KEY": "0x...", "RPC_URL": "https://polygon-rpc.com", "MAX_TX_USDC": "25", "MAX_DAILY_USDC": "500" } } } } ``` ``` ### Technical Analysis The instructions place `AGENT_PRIVATE_KEY` directly in a persistent JSON configuration file. Although signing authority is required for the declared non-custodial payment functionality, storing the raw key in plaintext is not the least-privilege approach. Any local user, process, extension, backup utility, synchronization service, diagnostic collector, or accidental repository commit with access to the configuration may disclose the key. File-based transaction limits do not constrain an attacker who obtains the private key because the key can be imported into another wallet or used by independent signing software. The flagged reference to `~/.config/claude/mcp.json` is relevant to legitimate MCP setup and does not itself demonstrate unauthorized reading of an existing credential file. The security issue is the instruction to persist a high-value signing secret in that configuration. ### Attack Path 1. A user inserts a funded wallet's private key into the MCP JSON configuration as instructed. 2. Another local process, extension, user, backup system, synchronization service, or compromised MCP dependency reads or receives the configuration secret. 3. The attacker extracts `AGENT_PRIVATE_KEY`. 4. The attacker imports the key into an independent signer or wallet. 5. Unauthorized transactions are signed outside the MCP server, bypassing `MAX_T ...[truncated 631 chars]
Remediation: ## Remediation Suggestions - Do not place a production wallet private key directly in persistent MCP JSON. - Store the secret in an operating-system keychain, hardware wallet, isolated signing service, or dedicated secret manager. - Retrieve credentials at runtime through a narrowly scoped mechanism rather than embedding them in the configuration. - Use a dedicated wallet with only the minimum balance required for the agent's immediate tasks. - Enforce transaction ceilings, destination allowlists, token restrictions, and approval thresholds at the signer or smart-contract wallet layer, not solely inside the MCP process. - Restrict configuration permissions to the owning user and prevent the file from being committed, synchronized, included in diagnostics, or stored in unencrypted backups. - Rotate the wallet immediately if its private key may have been exposed; merely removing it from the file does not invalidate the key. - Prefer short-lived or policy-constrained signing authorization where the target platform supports it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs users to place a live blockchain private key in MCP environment configuration but does not include any explicit warning about key handling, wallet isolation, or the risk that an agent runtime with payment tools can directly spend funds. In this context, the omission is dangerous because the skill is specifically enabling autonomous payments, so insecure key storage, over-privileged wallets, or accidental exposure of the config can lead to immediate, irreversible loss of USDC or other on-chain assets.

Static analysis

No suspicious patterns detected.