Security audit

OpenPayment

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it asks agents to create real crypto payment links through Bash with user-provided fields and has under-scoped proxy behavior.

Install only if you trust the OpenPayment npm package and are comfortable creating production Base USDC payment links from agent-collected inputs. Before use, confirm every amount, wallet address, network, description, and any PROXY resource URL, and avoid letting the agent interpolate untrusted text directly into Bash commands.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:28
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation
``` 2. Verify the package's provenance and integrity before installation, including the publisher, repository, release history, and npm integrity metadata. 3. Maintain a lockfile or equivalent controlled dependency manifest where the execution environment permits it. 4. Prefer a project-local installation over a global installation to reduce system-wide exposure. 5. Execute the package in an isolated, least-privileged environment with restricted filesystem, credential, and network access. 6. Disable npm lifecycle scripts where compatible with the package: ```bash npm install --ignore-scripts openpayment@ ``` 7. Review the pinned package and its transitive dependencies before approving upgrades. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:37
Finding: Shell Command Injection Through User-Controlled CLI Arguments
Content: View full analysis
" \ --price "" \ --payTo "" \ --network "" \ [--resourceUrl ""] \ --description "" ``` ```markdown ## Workflow for Handling User Requests The first time the skill runs, explain to the user what payment types and networks are allowed. 1. **Identify missing info** you need: amount (`--price`), receiver wallet address (`--payTo`). If `--type=PROXY`, also require `--resourceUrl`. 2. **Infer defaults**: type defaults to `SINGLE_USE`, network defaults to `eip155:8453` (Base Mainnet). 3. **Confirm info** with the user before creating. 4. **Run the command** using the bash tool. 5. **Present the payment URL** clearly to the user so they can share it. ``` ### Technical Analysis The workflow directs the agent to collect values from a user and interpolate them into a command executed through Bash. User-controlled values include the description and, for proxy payments, the resource URL. Surrounding input with double quotes does not make arbitrary data safe for shell evaluation. Bash still evaluates command substitutions such as `$(command)` and backtick expressions inside double-quoted strings. Shell parsing and expansion happen before the `openpayment` process receives its arguments. The document states that the CLI validates fields before making an API call, but CLI validation cannot prevent this issue because injected shell expressions execute before the CLI starts. The documented maximum description length and HTTPS URL checks likewise provide no protection if they are implemented only inside the CLI. For example, if a raw description containing `$(attacker_command)` is inserted into the template and the resulting command is executed by Bash, Bash evaluates `attacker_ ...[truncated 1606 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger guidance is very broad and includes generic phrases like creating a payment link or accepting USDC, which can cause the skill to activate in contexts where the user did not specifically intend to use this tool. In an agent environment, over-triggering can route ordinary payment-related conversations into execution paths that create real crypto payment requests on mainnet, increasing the chance of mistaken or unauthorized actions.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
## Payment Types | Type | When to use | | ------------ | ------------------------------------------------------------------------------------------- | | `SINGLE_USE` | One-time payment with fixed price (e.g., a specific order, invoice) | | `MULTI_USE` | Fixed price, can be paid multiple times (e.g., recurring product) |

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly supports PROXY payment links that invoke a private upstream API after settlement, which extends behavior beyond simple payment-link generation into triggering server-side actions. That increases risk because an agent could be induced to create links that cause real backend effects against user-supplied endpoints, potentially enabling SSRF-like abuse, unintended API invocation, or creation of payment-gated actions without sufficient review.
Content: No source excerpt is available for this finding.