Agent Payment Protocol

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:03 AM UTC
• Version: 0.1.0

Overview

This skill is openly payment-focused, but its examples encourage agent-driven Solana payments from IRC quotes without enough explicit confirmation or spending safeguards.

Install only if you are prepared to treat it as a real-money payment component. Use testnet or a small dedicated wallet, require explicit confirmation before every transfer, verify quote ID, recipient wallet, amount, and intent, set spending limits or allowlists, and review/retain the local JSONL ledgers carefully because they can contain financial history and chat-derived context.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: `recordPayment` updates the payment status based on the `confirmed` flag, but it unconditionally marks the related quote as `settled` whenever a quote is found. In a payment protocol, this creates an integrity flaw where unpaid or unconfirmed work can be treated as completed, enabling false settlement, audit corruption, and downstream release of services or funds based on incorrect state.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README instructs agents to execute real Solana transfers and persist transaction history locally, but it does not prominently warn that these actions can move real funds and create durable financial records. In an agent skill context, this omission is dangerous because downstream integrators may treat the example as safe-by-default automation and enable unintended payments or privacy-sensitive logging without informed consent or safeguards.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documented workflow proceeds from quote approval directly to invoking a Solana transfer without any explicit warning that blockchain payments are irreversible or any confirmation gate immediately before funds are sent. In an IRC-driven agent context, where payment details may be derived from chat content or automated logic, this omission increases the risk of accidental or socially engineered transfers that cannot be recovered once broadcast.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"test": "node test.js"
  },
  "dependencies": {
    "@solana/web3.js": "^1.87.0"
  },
  "keywords": ["solana", "irc", "agents", "payments", "protocol"]
}

• Confidence: 95% confidence
• Finding: The dependency is specified with a caret range, which allows installation of different upstream versions over time and weakens build reproducibility and supply-chain control. In a payment-related skill that handles Solana interactions, dependency drift increases the chance of unexpectedly pulling in a vulnerable or malicious release.

Known Vulnerable Dependency: @solana/web3.js==1.87.0 — 1 advisory(ies): CVE-2024-30253 (Handling untrusted input can result in a crash, leading to loss of availability )

High

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: The package references @solana/web3.js 1.87.0, which is flagged for CVE-2024-30253 where handling untrusted input can cause a crash and loss of availability. This skill's context makes the issue more significant because it is designed for agent-to-agent payments over IRC, a channel likely to carry untrusted external input that could trigger denial of service during payment processing.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.