Security audit

LobPay

Security checks across malware telemetry and agentic risk

Overview

LobPay matches its payment purpose, but it stores wallet secrets locally and can run blockchain-backed purchases without enough user confirmation or safeguards.

Review carefully before installing. Use only a dedicated low-balance wallet or testnet wallet, verify LOBPAY_API_URL before every use, avoid passing long-lived private keys on the command line, protect or delete ~/.lobpay/config.json, and require manual confirmation of merchant, amount, token, network, and quantity before running buy.js or purchase.js.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger list is broad enough to match ordinary commerce terms like "Buy," "Pay," and "Checkout," which can cause the skill to activate in contexts where the user did not explicitly intend to invoke a payment-capable workflow. In a skill that can initiate purchases and use local private keys, overbroad activation materially increases the chance of unintended financial actions or unsafe delegation to the skill.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill description advertises purchase and payment capabilities but does not prominently warn that it relies on locally stored private keys and can perform blockchain-backed transactions. Without strong upfront warnings and consent language, users or calling agents may invoke irreversible financial operations without understanding key-handling, signing, network selection, or transaction finality risks.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation describes a purchase flow that requires the client to sign an on-chain payment with a private key, but it does not prominently warn users that this action can trigger real blockchain settlement and asset transfer. In an agent/skill context, omitted warnings increase the risk that integrators or autonomous agents will blindly implement the flow and expose signing capability for unintended or irreversible payments.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script submits a paid purchase immediately after fetching checkout info, with no explicit user confirmation, spending limit, or secondary validation step. In a payment-capable agent skill, this increases the risk of accidental purchases, misuse through manipulated CLI inputs or automation, and unintended on-chain payment execution before the operator can review the final transaction details.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: The script silently persists checkout details to a predictable file in the user's home directory without informing the user or obtaining consent. While the stored data is not highly sensitive by itself, it may reveal purchase intent, merchant details, wallet addresses, and pricing information, and can create privacy and data-retention concerns on shared or monitored systems.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script persists both a private key and API key in plaintext under the user's home directory, creating a durable local secret store without any protection, permission hardening, or warning to the user. If the machine is shared, compromised, backed up insecurely, or the file is read by other local processes, these credentials can be stolen and used to impersonate the agent or access the associated API account.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/buy.js:9

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/checkout.js:6

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/feedback.js:6

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/history.js:6

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/register.js:8