AgentPay SDK

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:58 AM UTC
• Version: 0.3.1

Overview

The skill is a coherent AgentPay wallet/payment guide, but it relies on unsafe remote shell installation and documents payment flows that can accept server-selected charges.

Review this skill carefully before installing. Prefer local copy or verifiable release installation over `curl | bash`, require explicit confirmation of chain, token, recipient, amount, and broadcast intent before any payment, use `--amount` for MPP calls, keep wallet policies and manual approval limits conservative, and avoid external QR fallback URLs when privacy matters.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:34
• Finding: Unpinned Remote Installer Is Downloaded and Executed Directly by Bash<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:34-36` - `references/capabilities.md:5-7` - `references/install-and-workflows.md:5-9` - `references/install-and-workflows.md:26-29` - `references/install-and-workflows.md:84-87` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://wlfi.sh | bash ``` ```bash curl -fsSL https://wlfi.sh | bash -s -- --skills-only ``` The Skill also presents the same unpinned command as its update mechanism: ```bash curl -fsSL https://wlfi.sh | bash ``` ### Technical Analysis The installation instructions pipe a mutable HTTP response directly into Bash. The response is not saved for inspection and is not verified using a pinned checksum, cryptographic signature, immutable release identifier, or reproducible-build metadata. HTTPS protects the connection against some network attackers, but it does not establish that future content served by the domain is identical to the content reviewed during this audit. Compromise of the domain, hosting account, DNS configuration, TLS termination, publishing pipeline, or downstream release assets would allow the effective installer payload to change after the Skill package has been approved. The documented installer has broad effects. According to `references/install-and-workflows.md:10-24`, it can: - Download a prebuilt AgentPay runtime bundle. - Bootstrap Node.js when it is missing. - Install the `agentpay` executable. - Write Skill packs and adapters into multiple global and workspace locations. - Modify instruction files used by Codex, Claude, Cline, Goose, Windsurf, OpenClaw, Copilot, Cursor, and other agents. - Prepare a runtime that later operates as a managed daemon. These effects materially exceed the minimum privileges needed merely to install the static Skill directory. The `--skills-only` option is narrower in intended effect, but it still obtains and executes the same mutable r ...[truncated 1904 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove every `curl | bash` installation and update instruction. 2. Publish immutable, versioned release artifacts through a clearly attributable release channel. 3. Require users to download the installer and artifact separately before execution. 4. Publish SHA-256 checksums and cryptographic signatures through an independently protected channel. 5. Verify both the installer and every runtime bundle before execution. 6. Pin documentation to a specific release version instead of executing whatever content the domain currently serves. 7. Prefer a transparent package-manager installation with locked versions and verifiable provenance. 8. Make local Skill-directory copying the default installation method when only the Skill is required. 9. Separate Skill installation, runtime installation, adapter modification, and daemon setup into individually authorized operations. 10. Display an exact change plan before installation, including every file, binary, credential-store entry, and service that will be created or modified. 11. Avoid elevated privileges and explicitly abort if the installer is run as root unless a narrowly defined system-level operation genuinely requires it. 12. Provide a complete uninstall manifest and verify that uninstall removes launchers, services, adapters, and obsolete credentials without deleting wallet backups. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/mpp-services.md:14
• Finding: MPP Workflow Can Automatically Pay an Untrusted Server-Controlled Amount and Recipient<![CDATA[ ## Vulnerability Details **File Locations**: - `references/mpp-services.md:5-39` - `references/mpp-services.md:55-66` - `references/install-and-workflows.md:405-426` - `references/install-and-workflows.md:476-484` - `references/capabilities.md:30` - `references/capabilities.md:52-56` - `SKILL.md:198-200` **Vulnerability Type**: Unsafe automatic authorization of externally controlled blockchain payments **Risk Level**: High ### Vulnerable Code and Instructions The quick-start example omits an expected payment amount: ```bash # Discover a current endpoint from the live directory curl https://mpp.dev/services/llms.txt # Call a current MPP service -- amount is auto-accepted from the server challenge agentpay mpp https://parallelmpp.dev/api/search \ --method POST \ --header 'Content-Type: application/json' \ --json-body '{"query":"latest AI news","numResults":5}' \ --json ``` The documented behavior explicitly accepts the amount selected by the remote server: ```text The `--amount` flag is optional. When omitted, the CLI pays whatever the server asks. When provided, the CLI compares it against the challenge amount and refuses to pay if they differ. ``` The remote challenge determines all material payment fields: ```text Server responds with `402 Payment Required` and a `WWW-Authenticate` header containing a payment challenge (method, token, amount, recipient, chain). The CLI signs and broadcasts the chain-appropriate token payment for the challenge amount. ``` The Skill also delegates endpoint selection to mutable external content: ```text Discover current MPP LLM/search services from `https://mpp.dev/services/llms.txt`. ``` ### Technical Analysis The documented flow combines two externally controlled inputs: 1. A mutable remote directory determines which service endpoint the agent may select. 2. The selected endpoint determines the token, amount, recipient, and blockchain network through an HTTP 402 challenge. When `--amount` is omi ...[truncated 2514 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require `--amount` for every one-shot MPP request; do not present auto-acceptance as the default. 2. Treat the supplied amount as a strict maximum rather than only an equality check where protocol semantics permit. 3. Before signing, display and require confirmation of: - Service origin. - Recipient address. - Chain ID. - Token contract and symbol. - Exact amount. - Estimated gas. - Session deposit and cumulative spending cap, when applicable. 4. Use a pinned, locally maintained allowlist of reviewed service origins and expected recipient identities. 5. Treat the live directory only as discovery data, not as a trust authority. 6. Require manual approval for a new endpoint, changed recipient, changed token, changed chain, or amount above a low threshold. 7. Configure conservative per-transaction, daily, and weekly limits before enabling MPP. 8. Disable automatic session top-ups by default. 9. Require a user-approved cumulative session cap and reject server events that would exceed it. 10. Verify TLS origins and reject redirects to unapproved domains. 11. Record challenge details and transaction receipts in an auditable local log without including secret authentication material. 12. Clearly distinguish request preview from broadcast and require explicit broadcast authorization for irreversible payments. ]]>

other

Note

• Location: scripts/prepare-funding-request.mjs:141
• Finding: External QR Fallback Discloses Wallet Address and Chain Metadata to a Third Party<`, }; ``` The corresponding workflow recommends using the external URL as a fallback: ```text Default to the rendered QR image in chat. Use the QR URL if the host strips data-URI images. ``` ### Technical Analysis The helper safely generates an SVG QR code locally, but it also constructs a remote QuickChart URL whose query string contains the complete funding URI: ```text ethereum:<wallet-address>@<chain-id> ``` The script itself does not make a network request. Disclosure occurs if a chat client automatically fetches the URL, if the URL is rendered as an image, or if the user opens it. The third-party service then receives the wallet address and chain ID together with normal HTTP metadata such as source IP address, timestamp, user agent, and referrer where applicable. Wallet addresses and chain IDs are public data individually, but associating them with a particular requester, network location, agent session, and funding time creates avoidable privacy leakage. The external fallback is unnecessary because the same helper already produces a local SVG and data URI ...[truncated 1011 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the QuickChart fallback and use the locally generated SVG or SVG data URI exclusively. 2. If a data URI is unsupported, save the local SVG to a user-selected file rather than transmitting the payload to a third party. 3. If external rendering must remain available, make it explicitly opt-in. 4. Clearly disclose the exact wallet and chain metadata that will be sent to the external service. 5. Avoid automatic Markdown embedding that may trigger background requests without user interaction. 6. Support a configurable, self-hosted QR renderer for environments that cannot display local SVG content. 7. Add privacy-focused tests verifying that the default output does not reference an external image host. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (53)

External Script Fetching

High

• Category: Supply Chain

Content

## Ground Truth

- Use `agentpay --help` and the relevant subcommand help as the source of truth when examples disagree.
- One-click bootstrap: `curl -fsSL https://wlfi.sh | bash`
- One-click skills only: `curl -fsSL https://wlfi.sh | bash -s -- --skills-only`
- One-click update: rerun `curl -fsSL https://wlfi.sh | bash`
- One-click packaged runtime bundles are available on macOS and Linux. Managed wallet setup is supported on both platforms after install.

• Confidence: 99% confidence
• Finding: The skill recommends a one-line remote script execution pattern, `curl ... | bash`, for bootstrap. This is dangerous because it executes unaudited network content directly in a shell, allowing upstream compromise, domain hijack, or malicious script changes to immediately result in arbitrary code execution on the user's machine.

External Script Fetching

High

• Category: Supply Chain

Content

- Use `agentpay --help` and the relevant subcommand help as the source of truth when examples disagree.
- One-click bootstrap: `curl -fsSL https://wlfi.sh | bash`
- One-click skills only: `curl -fsSL https://wlfi.sh | bash -s -- --skills-only`
- One-click update: rerun `curl -fsSL https://wlfi.sh | bash`
- One-click packaged runtime bundles are available on macOS and Linux. Managed wallet setup is supported on both platforms after install.
- Source install or update: from the repo checkout run `pnpm install && npm run build && npm run install:cli-launcher && npm run install:rust-binaries`

• Confidence: 99% confidence
• Finding: The skills-only install path still uses `curl ... | bash -s -- --skills-only`, which preserves the same remote code execution risk as the main installer. The reduced scope of the install does not reduce the core danger, since arbitrary script content still runs with the user's privileges.

External Script Fetching

High

• Category: Supply Chain

Content

- Use `agentpay --help` and the relevant subcommand help as the source of truth when examples disagree.
- One-click bootstrap: `curl -fsSL https://wlfi.sh | bash`
- One-click skills only: `curl -fsSL https://wlfi.sh | bash -s -- --skills-only`
- One-click update: rerun `curl -fsSL https://wlfi.sh | bash`
- One-click packaged runtime bundles are available on macOS and Linux. Managed wallet setup is supported on both platforms after install.
- Source install or update: from the repo checkout run `pnpm install && npm run build && npm run install:cli-launcher && npm run install:rust-binaries`
- Managed wallet bootstrap commands such as `agentpay admin setup`, `agentpay admin tui`, `agentpay admin reset`, and `agentpay admin uninstall` are supported on macOS and Linux. The managed daemon uses `launchd` on macOS and system `systemd` on Linux. Agent auth storage uses macOS Keychain on macOS and Linux Secret Service on Linux.

• Confidence: 99% confidence
• Finding: The update path also instructs users to rerun the remote pipe-to-shell installer, creating a recurring arbitrary code execution channel every time the software is updated. In a wallet/payment skill, this is especially sensitive because the installed tooling may access funds, signing flows, policies, and local secrets.

External Script Fetching

High

• Category: Supply Chain

Content

## Use These Commands

- One-click bootstrap: `curl -fsSL https://wlfi.sh | bash`
- One-click skills only: `curl -fsSL https://wlfi.sh | bash -s -- --skills-only`
- One-click update: rerun `curl -fsSL https://wlfi.sh | bash`
- One-click packaged runtime bundles are available on macOS and Linux. Managed wallet setup is supported on both platforms after install.

• Confidence: 99% confidence
• Finding: `curl -fsSL https://wlfi.sh | bash` directly executes code fetched from the network with no integrity verification or review step. In a skill that installs wallet/payment software, this is especially dangerous because compromise of the installer could lead to host takeover, credential theft, wallet theft, or transaction tampering.

External Script Fetching

High

• Category: Supply Chain

Content

## Use These Commands

- One-click bootstrap: `curl -fsSL https://wlfi.sh | bash`
- One-click skills only: `curl -fsSL https://wlfi.sh | bash -s -- --skills-only`
- One-click update: rerun `curl -fsSL https://wlfi.sh | bash`
- One-click packaged runtime bundles are available on macOS and Linux. Managed wallet setup is supported on both platforms after install.
- Source install or update: `pnpm install && npm run build && npm run install:cli-launcher && npm run install:rust-binaries`

• Confidence: 99% confidence
• Finding: The skills-only variant still pipes a remote script into `bash`, so it carries the same arbitrary-code-execution risk as the full bootstrap flow. The reduced scope claim does not materially reduce the danger because the fetched script still controls what runs locally.

External Script Fetching

High

• Category: Supply Chain

Content

- One-click bootstrap: `curl -fsSL https://wlfi.sh | bash`
- One-click skills only: `curl -fsSL https://wlfi.sh | bash -s -- --skills-only`
- One-click update: rerun `curl -fsSL https://wlfi.sh | bash`
- One-click packaged runtime bundles are available on macOS and Linux. Managed wallet setup is supported on both platforms after install.
- Source install or update: `pnpm install && npm run build && npm run install:cli-launcher && npm run install:rust-binaries`
- Show config: `agentpay config show --json`

• Confidence: 98% confidence
• Finding: The update path instructs users to rerun the same remote pipe-to-bash command, creating a persistent supply-chain risk each time updates are performed. An attacker who compromises the endpoint later could exploit previously trusting users during routine maintenance.

External Script Fetching

High

• Category: Supply Chain

Content

Fastest packaged bootstrap on macOS or Linux:

```bash
curl -fsSL https://wlfi.sh | bash
```

That installer can:

• Confidence: 99% confidence
• Finding: `curl -fsSL https://wlfi.sh | bash` fetches code from the network and executes it immediately with no integrity verification or user review. In a payment/wallet installation flow, compromise of that URL, DNS, TLS trust chain, or hosting would yield instant arbitrary code execution and likely full compromise of wallet setup and agent configuration.

Chaining Abuse

High

• Category: Tool Misuse

Content

Fastest packaged bootstrap on macOS or Linux:

```bash
curl -fsSL https://wlfi.sh | bash
```

That installer can:

• Confidence: 97% confidence
• Finding: The pipeline chains untrusted network input directly into a shell interpreter, eliminating any inspection boundary and enabling one-step exploitation. In this skill context, that abuse can immediately lead to persistence in agent config locations and compromise of wallet-related assets.

External Script Fetching

High

• Category: Supply Chain

Content

If the user only wants the skill pack and editor adapters, use:

```bash
curl -fsSL https://wlfi.sh | bash -s -- --skills-only
```

That path skips the AgentPay SDK runtime install and only writes the AI skill targets.

• Confidence: 99% confidence
• Finding: The `--skills-only` installer uses the same remote pipe-to-shell pattern and additionally modifies trusted agent/workspace files. An attacker controlling the fetched script could implant persistent malicious instructions into multiple assistant environments, making the danger broader than a temporary command execution.

External Script Fetching

High

• Category: Supply Chain

Content

One-click updates use the same bootstrap entrypoint:

```bash
curl -fsSL https://wlfi.sh | bash
```

If the runtime has already been refreshed and the user only needs to reconnect the existing local vault, use:

• Confidence: 99% confidence
• Finding: Using the same `curl | bash` bootstrap for updates creates a recurring arbitrary-code-execution path, expanding exposure over time even after initial installation. Because this software manages payment and wallet workflows, an update compromise could silently alter transaction behavior or harvest credentials.

Chaining Abuse

High

• Category: Tool Misuse

Content

One-click updates use the same bootstrap entrypoint:

```bash
curl -fsSL https://wlfi.sh | bash
```

If the runtime has already been refreshed and the user only needs to reconnect the existing local vault, use:

• Confidence: 97% confidence
• Finding: The update command repeats the same hazardous chaining pattern, so any compromise of the remote script source turns a routine update into code execution. Because users are trained to run it for maintenance, the trust and frequency make exploitation more plausible and damaging.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill description is extremely broad and authorizes the skill for installation, wallet setup, funding, policy changes, approvals, and payment execution. In an agent environment, such broad routing increases the chance the skill is invoked for many loosely related financial requests, expanding the attack surface and enabling unintended high-risk actions with a wallet toolchain.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- `agentpay admin setup --reuse-existing-wallet` is the managed-daemon recovery / local re-setup path when the current vault should be preserved.
- `agentpay admin setup --restore-wallet-from <PATH>` restores the same wallet from an encrypted offline backup on macOS or Linux.
- `agentpay admin wallet-backup export --output <PATH>` creates an encrypted offline backup.
- Do not use `sudo agentpay ...`.
- Do not tell users to run `agentpay daemon` directly.

## Wallet Model

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The instruction to use the skill whenever a task 'touches wallet setup, funding, policy, transfers, approvals, or backups' defines activation in very broad terms without clear boundaries or exclusion cases. Terms like 'policy' and 'approvals' are especially generic and could overlap with unrelated user requests, increasing the risk of accidental invocation.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The instruction says to use the skill whenever a task "touches wallet setup, funding, policy, transfers, approvals, or backups," which is a wide set of common concepts without explicit boundaries or exclusion conditions. In a markdown skill file, this can create ambiguity about when the skill should activate versus when a task only mentions these topics incidentally.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The instruction to use the skill whenever a task 'touches wallet setup, funding, policy, transfers, approvals, or backups' is expansive and lacks explicit scope limits or exclusion examples. Terms like 'policy' and 'approvals' are broad enough to overlap with unrelated everyday tasks, which could cause unintended invocation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- start from `agentpay config show --json`
- use `agentpay wallet --json` to determine whether a reusable wallet already exists
- if the user only asks what the skill can do, answer from `SKILL.md` and do not probe the machine first
- never ask the user to paste `VAULT_PASSWORD` or a wallet backup password into chat
- if wallet metadata is unavailable and the user is trying to use the wallet, tell them to run `agentpay admin setup` locally
- if the wallet exists and the user wants to preserve it while re-running setup, tell them to run `agentpay admin setup --reuse-existing-wallet` locally
- if the local wallet is gone but the user has an encrypted backup, tell them to run `agentpay admin setup --restore-wallet-from <PATH>` locally

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- start from `agentpay config show --json`
- use `agentpay wallet --json` to determine whether a reusable wallet already exists
- if the user only asks what the skill can do, answer from `SKILL.md` and do not probe the machine first
- never ask the user to paste `VAULT_PASSWORD` or a wallet backup password into chat
- if wallet metadata is unavailable and the user is trying to use the wallet, tell them to run `agentpay admin setup` locally
- if the wallet exists and the user wants to preserve it while re-running setup, tell them to run `agentpay admin setup --reuse-existing-wallet` locally
- if the local wallet is gone but the user has an encrypted backup, tell them to run `agentpay admin setup --restore-wallet-from <PATH>` locally

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- start from `agentpay config show --json`
- use `agentpay wallet --json` to determine whether a reusable wallet already exists
- if the user only asks what the skill can do, answer from `SKILL.md` and do not probe the machine first
- never ask the user to paste `VAULT_PASSWORD` or a wallet backup password into chat
- if wallet metadata is unavailable and the user is trying to use the wallet, tell them to run `agentpay admin setup` locally
- if the wallet exists and the user wants to preserve it while re-running setup, tell them to run `agentpay admin setup --reuse-existing-wallet` locally
- if the local wallet is gone but the user has an encrypted backup, tell them to run `agentpay admin setup --restore-wallet-from <PATH>` locally

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- start from `agentpay config show --json`
- use `agentpay wallet --json` to determine whether a reusable wallet already exists
- if the user only asks what the skill can do, answer from `SKILL.md` and do not probe the machine first
- never ask the user to paste `VAULT_PASSWORD` or a wallet backup password into chat
- if wallet metadata is unavailable and the user is trying to use the wallet, tell them to run `agentpay admin setup` locally
- if the wallet exists and the user wants to preserve it while re-running setup, tell them to run `agentpay admin setup --reuse-existing-wallet` locally
- if the local wallet is gone but the user has an encrypted backup, tell them to run `agentpay admin setup --restore-wallet-from <PATH>` locally

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- start from `agentpay config show --json`
- use `agentpay wallet --json` to determine whether a reusable wallet already exists
- if the user only asks what the skill can do, answer from `SKILL.md` and do not probe the machine first
- never ask the user to paste `VAULT_PASSWORD` or a wallet backup password into chat
- if wallet metadata is unavailable and the user is trying to use the wallet, tell them to run `agentpay admin setup` locally
- if the wallet exists and the user wants to preserve it while re-running setup, tell them to run `agentpay admin setup --reuse-existing-wallet` locally
- if the local wallet is gone but the user has an encrypted backup, tell them to run `agentpay admin setup --restore-wallet-from <PATH>` locally

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

interface:
  display_name: "AgentPay SDK"
  short_description: "Install, fund, and operate the AgentPay SDK stack"
  default_prompt: "Use $agentpay-sdk to explain AgentPay SDK capabilities directly when asked, install and operate `agentpay`, set up or reuse a wallet on macOS or Linux, describe the managed `agentpay admin setup` and `agentpay admin tui` flows as supported on both platforms, note that the managed daemon uses `launchd` on macOS and system `systemd` on Linux, default unspecified payments to USD1 on BSC, check both the settlement asset and native gas balance before outbound actions, route policy changes to `agentpay admin tui`, treat manual approval as a pending user-approval state, send users to the local admin CLI approval commands, tell users to keep the original command running for `transfer --broadcast`, `transfer-native --broadcast`, `approve --broadcast`, and `bitrefill buy --broadcast` instead of rerunning after approval, use `agentpay admin resume-manual-approval-request --approval-request-id <UUID>` if an approved broadcast request needs to be resumed after the original command has exited, treat Bitrefill as one supported plugin-specific merchant payment flow rather than the headline path, never ask the user to paste `VAULT_PASSWORD` or plugin session material into chat, and execute the current CLI commands exactly as `agentpay --help` describes them."

policy:
  allow_implicit_invocation: true

• Confidence: 84% confidence
• Finding: The prompt directs the agent to make operational decisions such as defaulting unspecified payments to USD1 on BSC and to execute current CLI commands exactly as described, which delegates meaningful financial and procedural choices to the agent. In a payments context, autonomous defaults and action-oriented instructions are dangerous because they can cause transfers on the wrong asset/network or advance high-risk workflows without sufficiently explicit user authorization.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The default prompt contains broad activation and operational language that encourages the skill to install and operate a payment SDK, set up or reuse wallets, and execute payment-related CLI actions. In a financial skill, broad triggering increases the chance the agent invokes sensitive payment functionality in contexts that are only partially related, leading to unintended fund movement or wallet manipulation.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Enabling implicit invocation without tight contextual constraints allows this skill to activate automatically in conversations that mention related concepts, even when the user has not clearly requested payment operations. Because the skill handles wallets, balances, approvals, and broadcasts, mistaken invocation can escalate into sensitive financial actions or disclosure of operational payment state.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The file recommends multiple `curl ... | bash` one-click install/update flows without warning about the risks of piping remote content directly into a shell. If the remote endpoint, DNS, TLS trust chain, or hosting account is compromised, users could execute arbitrary code immediately on their machine.

Static analysis

No suspicious patterns detected.