Security audit

AgentPay SDK

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent AgentPay wallet/payment guide, but it relies on unsafe remote shell installation and documents payment flows that can accept server-selected charges.

Review this skill carefully before installing. Prefer local copy or verifiable release installation over `curl | bash`, require explicit confirmation of chain, token, recipient, amount, and broadcast intent before any payment, use `--amount` for MPP calls, keep wallet policies and manual approval limits conservative, and avoid external QR fallback URLs when privacy matters.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:34
Finding: Unpinned Remote Installer Is Downloaded and Executed Directly by Bash
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/mpp-services.md:14
Finding: MPP Workflow Can Automatically Pay an Untrusted Server-Controlled Amount and Recipient
Content: View full analysis
Remediation: View remediation

other

Note

Location: scripts/prepare-funding-request.mjs:141
Finding: External QR Fallback Discloses Wallet Address and Chain Metadata to a Third Party
Content: View full analysis
@ ``` The script itself does not make a network request. Disclosure occurs if a chat client automatically fetches the URL, if the URL is rendered as an image, or if the user opens it. The third-party service then receives the wallet address and chain ID together with normal HTTP metadata such as source IP address, timestamp, user agent, and referrer where applicable. Wallet addresses and chain IDs are public data individually, but associating them with a particular requester, network location, agent session, and funding time creates avoidable privacy leakage. The external fallback is unnecessary because the same helper already produces a local SVG and data URI ...[truncated 1011 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (53)

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The skill recommends a one-line remote script execution pattern, curl ... | bash, for bootstrap. This is dangerous because it executes unaudited network content directly in a shell, allowing upstream compromise, domain hijack, or malicious script changes to immediately result in arbitrary code execution on the user's machine.
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
## Ground Truth - Use `agentpay --help` and the relevant subcommand help as the source of truth when examples disagree. - One-click bootstrap: `curl -fsSL https://wlfi.sh | bash` - One-click skills only: `curl -fsSL https://wlfi.sh | bash -s -- --skills-only` - One-click update: rerun `curl -fsSL https://wlfi.sh | bash` - One-click packaged runtime bundles are available on macOS and Linux. Managed wallet setup is supported on both platforms after install.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The skills-only install path still uses curl ... | bash -s -- --skills-only, which preserves the same remote code execution risk as the main installer. The reduced scope of the install does not reduce the core danger, since arbitrary script content still runs with the user's privileges.
Content: Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.
md
- Use `agentpay --help` and the relevant subcommand help as the source of truth when examples disagree. - One-click bootstrap: `curl -fsSL https://wlfi.sh | bash` - One-click skills only: `curl -fsSL https://wlfi.sh | bash -s -- --skills-only` - One-click update: rerun `curl -fsSL https://wlfi.sh | bash` - One-click packaged runtime bundles are available on macOS and Linux. Managed wallet setup is supported on both platforms after install. - Source install or update: from the repo checkout run `pnpm install && npm run build && npm run install:cli-launcher && npm run install:rust-binaries`

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The update path also instructs users to rerun the remote pipe-to-shell installer, creating a recurring arbitrary code execution channel every time the software is updated. In a wallet/payment skill, this is especially sensitive because the installed tooling may access funds, signing flows, policies, and local secrets.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
- Use `agentpay --help` and the relevant subcommand help as the source of truth when examples disagree. - One-click bootstrap: `curl -fsSL https://wlfi.sh | bash` - One-click skills only: `curl -fsSL https://wlfi.sh | bash -s -- --skills-only` - One-click update: rerun `curl -fsSL https://wlfi.sh | bash` - One-click packaged runtime bundles are available on macOS and Linux. Managed wallet setup is supported on both platforms after install. - Source install or update: from the repo checkout run `pnpm install && npm run build && npm run install:cli-launcher && npm run install:rust-binaries` - Managed wallet bootstrap commands such as `agentpay admin setup`, `agentpay admin tui`, `agentpay admin reset`, and `agentpay admin uninstall` are supported on macOS and Linux. The managed daemon uses `launchd` on macOS and system `systemd` on Linux. Agent auth storage uses macOS Keychain on macOS and Linux Secret Service on Linux.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: curl -fsSL https://wlfi.sh | bash directly executes code fetched from the network with no integrity verification or review step. In a skill that installs wallet/payment software, this is especially dangerous because compromise of the installer could lead to host takeover, credential theft, wallet theft, or transaction tampering.
Content: Scanner excerpt · references/capabilities.md (reported line 5)May include surrounding context.
md
## Use These Commands - One-click bootstrap: `curl -fsSL https://wlfi.sh | bash` - One-click skills only: `curl -fsSL https://wlfi.sh | bash -s -- --skills-only` - One-click update: rerun `curl -fsSL https://wlfi.sh | bash` - One-click packaged runtime bundles are available on macOS and Linux. Managed wallet setup is supported on both platforms after install.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The skills-only variant still pipes a remote script into bash, so it carries the same arbitrary-code-execution risk as the full bootstrap flow. The reduced scope claim does not materially reduce the danger because the fetched script still controls what runs locally.
Content: Scanner excerpt · references/capabilities.md (reported line 6)May include surrounding context.
md
## Use These Commands - One-click bootstrap: `curl -fsSL https://wlfi.sh | bash` - One-click skills only: `curl -fsSL https://wlfi.sh | bash -s -- --skills-only` - One-click update: rerun `curl -fsSL https://wlfi.sh | bash` - One-click packaged runtime bundles are available on macOS and Linux. Managed wallet setup is supported on both platforms after install. - Source install or update: `pnpm install && npm run build && npm run install:cli-launcher && npm run install:rust-binaries`

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The update path instructs users to rerun the same remote pipe-to-bash command, creating a persistent supply-chain risk each time updates are performed. An attacker who compromises the endpoint later could exploit previously trusting users during routine maintenance.
Content: Scanner excerpt · references/capabilities.md (reported line 7)May include surrounding context.
md
- One-click bootstrap: `curl -fsSL https://wlfi.sh | bash` - One-click skills only: `curl -fsSL https://wlfi.sh | bash -s -- --skills-only` - One-click update: rerun `curl -fsSL https://wlfi.sh | bash` - One-click packaged runtime bundles are available on macOS and Linux. Managed wallet setup is supported on both platforms after install. - Source install or update: `pnpm install && npm run build && npm run install:cli-launcher && npm run install:rust-binaries` - Show config: `agentpay config show --json`

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: curl -fsSL https://wlfi.sh | bash fetches code from the network and executes it immediately with no integrity verification or user review. In a payment/wallet installation flow, compromise of that URL, DNS, TLS trust chain, or hosting would yield instant arbitrary code execution and likely full compromise of wallet setup and agent configuration.
Content: Scanner excerpt · references/install-and-workflows.md (reported line 8)May include surrounding context.
Fastest packaged bootstrap on macOS or Linux:

bash
curl -fsSL https://wlfi.sh | bash

That installer can:

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The pipeline chains untrusted network input directly into a shell interpreter, eliminating any inspection boundary and enabling one-step exploitation. In this skill context, that abuse can immediately lead to persistence in agent config locations and compromise of wallet-related assets.
Content: Scanner excerpt · references/install-and-workflows.md (reported line 8)May include surrounding context.
Fastest packaged bootstrap on macOS or Linux:

bash
curl -fsSL https://wlfi.sh | bash

That installer can:

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The --skills-only installer uses the same remote pipe-to-shell pattern and additionally modifies trusted agent/workspace files. An attacker controlling the fetched script could implant persistent malicious instructions into multiple assistant environments, making the danger broader than a temporary command execution.
Content: Scanner excerpt · references/install-and-workflows.md (reported line 28)May include surrounding context.
If the user only wants the skill pack and editor adapters, use:

bash
curl -fsSL https://wlfi.sh | bash -s -- --skills-only

That path skips the AgentPay SDK runtime install and only writes the AI skill targets.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: Using the same curl | bash bootstrap for updates creates a recurring arbitrary-code-execution path, expanding exposure over time even after initial installation. Because this software manages payment and wallet workflows, an update compromise could silently alter transaction behavior or harvest credentials.
Content: Scanner excerpt · references/install-and-workflows.md (reported line 86)May include surrounding context.
One-click updates use the same bootstrap entrypoint:

bash
curl -fsSL https://wlfi.sh | bash

If the runtime has already been refreshed and the user only needs to reconnect the existing local vault, use:

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The update command repeats the same hazardous chaining pattern, so any compromise of the remote script source turns a routine update into code execution. Because users are trained to run it for maintenance, the trust and frequency make exploitation more plausible and damaging.
Content: Scanner excerpt · references/install-and-workflows.md (reported line 86)May include surrounding context.
One-click updates use the same bootstrap entrypoint:

bash
curl -fsSL https://wlfi.sh | bash

If the runtime has already been refreshed and the user only needs to reconnect the existing local vault, use:

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill description is extremely broad and authorizes the skill for installation, wallet setup, funding, policy changes, approvals, and payment execution. In an agent environment, such broad routing increases the chance the skill is invoked for many loosely related financial requests, expanding the attack surface and enabling unintended high-risk actions with a wallet toolchain.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
- `agentpay admin setup --reuse-existing-wallet` is the managed-daemon recovery / local re-setup path when the current vault should be preserved. - `agentpay admin setup --restore-wallet-from <PATH>` restores the same wallet from an encrypted offline backup on macOS or Linux. - `agentpay admin wallet-backup export --output <PATH>` creates an encrypted offline backup. - Do not use `sudo agentpay ...`. - Do not tell users to run `agentpay daemon` directly. ## Wallet Model

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instruction to use the skill whenever a task 'touches wallet setup, funding, policy, transfers, approvals, or backups' defines activation in very broad terms without clear boundaries or exclusion cases. Terms like 'policy' and 'approvals' are especially generic and could overlap with unrelated user requests, increasing the risk of accidental invocation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instruction says to use the skill whenever a task "touches wallet setup, funding, policy, transfers, approvals, or backups," which is a wide set of common concepts without explicit boundaries or exclusion conditions. In a markdown skill file, this can create ambiguity about when the skill should activate versus when a task only mentions these topics incidentally.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction to use the skill whenever a task 'touches wallet setup, funding, policy, transfers, approvals, or backups' is expansive and lacks explicit scope limits or exclusion examples. Terms like 'policy' and 'approvals' are broad enough to overlap with unrelated everyday tasks, which could cause unintended invocation.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · agents/AGENTS.md (reported line 10)May include surrounding context.
md
- start from `agentpay config show --json` - use `agentpay wallet --json` to determine whether a reusable wallet already exists - if the user only asks what the skill can do, answer from `SKILL.md` and do not probe the machine first - never ask the user to paste `VAULT_PASSWORD` or a wallet backup password into chat - if wallet metadata is unavailable and the user is trying to use the wallet, tell them to run `agentpay admin setup` locally - if the wallet exists and the user wants to preserve it while re-running setup, tell them to run `agentpay admin setup --reuse-existing-wallet` locally - if the local wallet is gone but the user has an encrypted backup, tell them to run `agentpay admin setup --restore-wallet-from <PATH>` locally

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · agents/CLAUDE.md (reported line 10)May include surrounding context.
md
- start from `agentpay config show --json` - use `agentpay wallet --json` to determine whether a reusable wallet already exists - if the user only asks what the skill can do, answer from `SKILL.md` and do not probe the machine first - never ask the user to paste `VAULT_PASSWORD` or a wallet backup password into chat - if wallet metadata is unavailable and the user is trying to use the wallet, tell them to run `agentpay admin setup` locally - if the wallet exists and the user wants to preserve it while re-running setup, tell them to run `agentpay admin setup --reuse-existing-wallet` locally - if the local wallet is gone but the user has an encrypted backup, tell them to run `agentpay admin setup --restore-wallet-from <PATH>` locally

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · agents/GEMINI.md (reported line 10)May include surrounding context.
md
- start from `agentpay config show --json` - use `agentpay wallet --json` to determine whether a reusable wallet already exists - if the user only asks what the skill can do, answer from `SKILL.md` and do not probe the machine first - never ask the user to paste `VAULT_PASSWORD` or a wallet backup password into chat - if wallet metadata is unavailable and the user is trying to use the wallet, tell them to run `agentpay admin setup` locally - if the wallet exists and the user wants to preserve it while re-running setup, tell them to run `agentpay admin setup --reuse-existing-wallet` locally - if the local wallet is gone but the user has an encrypted backup, tell them to run `agentpay admin setup --restore-wallet-from <PATH>` locally

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · agents/cline-agentpay-sdk.md (reported line 10)May include surrounding context.
md
- start from `agentpay config show --json` - use `agentpay wallet --json` to determine whether a reusable wallet already exists - if the user only asks what the skill can do, answer from `SKILL.md` and do not probe the machine first - never ask the user to paste `VAULT_PASSWORD` or a wallet backup password into chat - if wallet metadata is unavailable and the user is trying to use the wallet, tell them to run `agentpay admin setup` locally - if the wallet exists and the user wants to preserve it while re-running setup, tell them to run `agentpay admin setup --reuse-existing-wallet` locally - if the local wallet is gone but the user has an encrypted backup, tell them to run `agentpay admin setup --restore-wallet-from <PATH>` locally

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · agents/copilot-instructions.md (reported line 10)May include surrounding context.
md
- start from `agentpay config show --json` - use `agentpay wallet --json` to determine whether a reusable wallet already exists - if the user only asks what the skill can do, answer from `SKILL.md` and do not probe the machine first - never ask the user to paste `VAULT_PASSWORD` or a wallet backup password into chat - if wallet metadata is unavailable and the user is trying to use the wallet, tell them to run `agentpay admin setup` locally - if the wallet exists and the user wants to preserve it while re-running setup, tell them to run `agentpay admin setup --reuse-existing-wallet` locally - if the local wallet is gone but the user has an encrypted backup, tell them to run `agentpay admin setup --restore-wallet-from <PATH>` locally

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 84% confidence
Finding: The prompt directs the agent to make operational decisions such as defaulting unspecified payments to USD1 on BSC and to execute current CLI commands exactly as described, which delegates meaningful financial and procedural choices to the agent. In a payments context, autonomous defaults and action-oriented instructions are dangerous because they can cause transfers on the wrong asset/network or advance high-risk workflows without sufficiently explicit user authorization.
Content: Scanner excerpt · agents/openai.yaml (reported line 4)May include surrounding context.
yaml
interface: display_name: "AgentPay SDK" short_description: "Install, fund, and operate the AgentPay SDK stack" default_prompt: "Use $agentpay-sdk to explain AgentPay SDK capabilities directly when asked, install and operate `agentpay`, set up or reuse a wallet on macOS or Linux, describe the managed `agentpay admin setup` and `agentpay admin tui` flows as supported on both platforms, note that the managed daemon uses `launchd` on macOS and system `systemd` on Linux, default unspecified payments to USD1 on BSC, check both the settlement asset and native gas balance before outbound actions, route policy changes to `agentpay admin tui`, treat manual approval as a pending user-approval state, send users to the local admin CLI approval commands, tell users to keep the original command running for `transfer --broadcast`, `transfer-native --broadcast`, `approve --broadcast`, and `bitrefill buy --broadcast` instead of rerunning after approval, use `agentpay admin resume-manual-approval-request --approval-request-id <UUID>` if an approved broadcast request needs to be resumed after the original command has exited, treat Bitrefill as one supported plugin-specific merchant payment flow rather than the headline path, never ask the user to paste `VAULT_PASSWORD` or plugin session material into chat, and execute the current CLI commands exactly as `agentpay --help` describes them." policy: allow_implicit_invocation: true

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The default prompt contains broad activation and operational language that encourages the skill to install and operate a payment SDK, set up or reuse wallets, and execute payment-related CLI actions. In a financial skill, broad triggering increases the chance the agent invokes sensitive payment functionality in contexts that are only partially related, leading to unintended fund movement or wallet manipulation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Enabling implicit invocation without tight contextual constraints allows this skill to activate automatically in conversations that mention related concepts, even when the user has not clearly requested payment operations. Because the skill handles wallets, balances, approvals, and broadcasts, mistaken invocation can escalate into sensitive financial actions or disclosure of operational payment state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file recommends multiple curl ... | bash one-click install/update flows without warning about the risks of piping remote content directly into a shell. If the remote endpoint, DNS, TLS trust chain, or hosting account is compromised, users could execute arbitrary code immediately on their machine.
Content: No source excerpt is available for this finding.