PayMe - Crypto Payments

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:29 PM UTC
• Version: 1.0.27

Overview

This instruction-only PayMe skill is not deceptive, but it needs Review because it asks agents to handle a reusable financial PIN and broad renewable payment tokens.

Review carefully before installing. Use this only in an agent environment with encrypted secret storage, prefer the web-generated connection-code flow, keep Direct Execute off unless you intentionally accept one-call transfers, revoke tokens when done, and avoid creating a new PayMe account through chat unless you immediately rotate the PIN in PayMe afterward.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:44

Finding

Reusable Financial Account PIN Is Collected Through Agent Chat

Content

View full analysis

", "installationId": "" } ``` The subsequent instructions acknowledge that the PIN was exposed through chat: ```markdown - **Ask them to delete the message containing their chosen PIN** from the chat, or clear the chat after the current session to get rid of it - **Suggest rotating the PIN:** "You can change your PIN anytime at payme.feedom.tech → Settings → Change PIN — good practice after sharing it in chat" ``` The security section repeats the same workflow: ```markdown During account creation (`/api/agent/create-account`), the user **chooses a new PIN** for their future web/Telegram login. This is the **only** context where a PIN is handled. The agent does **not** ask for or receive an existing PIN — the user invents one on the spot. - PINs must be **6-8 digits** (enforced server-side). Old 4-digit PINs are blocked — users must upgrade via the web app before transacting. - The agent **never stores or reuses** the PIN — it is sent once in the POST body and immediately discarded. - **Always instruct the user to delete the chat message containing their chosen PIN**, or clear the chat after the session. - **Recommend rotating the PIN** after setup: tell the user they can change their PIN anytime at [payme.feedom.tech](https://payme.feedom.tech) → Settings → Change PIN. This is especially important i ...[truncated 2107 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/api-reference.md:68

Finding

Connection Tokens Receive Broad Financial Permissions and Can Be Repeatedly Refreshed

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:419

Finding

Conflicting Spending-Limit Documentation Can Cause Incorrect Security Assumptions

Content

View full analysis

AI Agent Access > Daily spend limit** (up to $10,000). - The limits apply to all agent-initiated transfers (both direct-execute and two-step confirm). The daily limit resets every 24 hours. - When a limit is reached, the API returns a `403` with `code: "AGENT_SPEND_LIMIT"` or `"AGENT_SINGLE_LIMIT"`. ``` The bundled API reference instead states: ```markdown **Daily Spend Limit:** Agents are subject to a per-user daily spending cap (default $500/day, configurable $10–$10,000). This resets every 24 hours. When the limit is hit, both direct-execute sends and 2-step confirms will be rejected. The user must increase their limit in the PayMe app (requires their PIN) or use the app directly for that transfer. ``` The API request schema also documents a much larger syntactic amount range: ```markdown - `amount`: number or string, must be > 0 and <= 1,000,000 ``` ### Technical Analysis The two files provide different values for the default daily spending limit: `$100/day` in `SKILL.md` and `$500/day` in the API reference. The main skill also claims a `$100` per-transaction cap, while the API schema accepts an amount up to `1,000,000` before any separate policy enforcement is considered. An API validation maximum is not necessarily the same as an agent spending-policy maximum, so the large request range alone does not prove that the server permits a transfer above the clai ...[truncated 1260 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

text

GET /api/agent/contacts
POST /api/agent/contacts  { "name": "Alice", "address": "0x..." }
DELETE /api/agent/contacts/:name
GET /api/agent/search?q=chris   (fuzzy search users & contacts)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 296)May include surrounding context.

text

GET /api/agent/contacts
POST /api/agent/contacts  { "name": "Alice", "address": "0x..." }
DELETE /api/agent/contacts/:name
GET /api/agent/search?q=chris   (fuzzy search users & contacts)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description says payments require explicit user confirmation by default, but the API also supports execute: true, allowing a single call to both prepare and send funds immediately. This mismatch can mislead users and integrators into assuming a guaranteed two-step confirmation flow when the agent can directly execute transfers if prompted or misconfigured.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 635)May include surrounding context.

md

---

## DELETE /api/agent/p2p/bank-accounts/:id

**Scope:** `payments:execute`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

Once the user provides a code, call:

bash

curl -X POST https://api.feedom.tech/api/agent/connect \
  -H "Content-Type: application/json" \
  -d '{"code": "THE_CODE_USER_GAVE_YOU", "installationId": "<stable-installation-id>"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

Once the user provides a code, call:

bash

curl -X POST https://api.feedom.tech/api/agent/connect \
  -H "Content-Type: application/json" \
  -d '{"code": "THE_CODE_USER_GAVE_YOU", "installationId": "<stable-installation-id>"}'

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md

Returns the `preview` **and** `txHash` together.

If a user asks you to "skip confirmations" or "enable direct execute", tell them: *"You can enable direct execute from your PayMe web app settings at payme.feedom.tech → Settings → AI Agents. It's disabled by default for your safety."*

### View Transaction History

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The default prompt 'Check my PayMe wallet balance' is broad and automatically steers the agent into a sensitive financial capability without an explicit user-scoped trigger or clearer boundary conditions. In a crypto-payment skill, even balance access can expose wallet metadata or prime the agent to continue into higher-risk payment flows, so an overbroad default entry point increases the chance of unintended sensitive actions or data exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The API reference exposes materially broader capabilities than the manifest description, including vendor trade-management actions that can accept, reject, mark paid, and cancel P2P orders. Scope drift is dangerous because users and host systems may grant or trust the skill for consumer payments while the implementation also supports higher-risk operational actions that affect escrowed funds and marketplace behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The P2P order confirmation endpoint irreversibly releases escrow to the vendor, yet the documentation does not mandate a strong user warning or confirmation ritual before calling it. In a conversational agent setting, that omission is risky because a vague instruction or social-engineering prompt could cause irreversible loss of escrowed crypto after a false claim of fiat payment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The undocumented revenue-ownership/status endpoint expands data access beyond the stated skill description, creating hidden financial profiling capability. Even if read-only, undisclosed access to ownership share, rankings, and payout estimates can expose sensitive financial metadata users did not expect the agent to handle.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.