NodPay

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:19 AM UTC
• Version: 0.2.33

Overview

This payment skill is coherent and disclosed, but it handles crypto signing authority through persistent local secrets and unpinned npm execution.

Review this carefully before installing. It is not shown to be malicious, and its sensitive behavior is mostly disclosed, but it handles crypto payment proposals, keeps an agent signing key on disk, and runs an unpinned npm CLI. Use only with funds you are comfortable risking, verify every recipient, chain, amount, nonce, and approval URL independently, and prefer a pinned or preinstalled reviewed CLI with restricted access to `~/.nodpay`.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:56

Finding

Unpinned Third-Party Package Execution in a Credential-Bearing Context

Content

View full analysis

\ --safe \ --to \ --value-eth \ --nonce \ --human-signer-passkey-x \ --human-signer-passkey-y \ --recovery-signer ``` The same unversioned executable is also used for transaction, nonce, and gas-price queries: ```bash npx nodpay txs --safe npx nodpay nonce --safe --chain npx nodpay gasprice --chain ``` ### Technical Analysis The Skill repeatedly invokes `npx nodpay` without specifying an exact package version, lockfile, package integrity hash, or other immutable artifact identifier. In an environment where the package is not already installed, `npx` may resolve and download the package currently published under the `nodpay` name. Consequently, the code executed during a future Skill invocation can differ from the code that was reviewed. The metadata identifies a GitHub source repository, but the documented commands resolve through the npm ecosystem and do not verify that the retrieved npm artifact corresponds to a reviewed source revision. This dependency executes in a particularly sensitive context. According to the Skill specification, the CLI reads the agent signing key from `~/.nodpay/.env` and creates signed cryptocurrency payment proposals. A compromised dependency would therefore execute with both the operating-system permissions of the Agent user and access to wallet-related credentials. ### Attack Path 1. An att ...[truncated 1611 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:91

Finding

Unquoted User-Controlled Values in Shell Command Templates

Content

View full analysis

``` The payment proposal template similarly places multiple potentially user-supplied values into unquoted command arguments: ```bash npx nodpay propose \ --chain \ --safe \ --to \ --value-eth \ --nonce \ --human-signer-passkey-x \ --human-signer-passkey-y \ --recovery-signer ``` Additional affected templates include: ```bash npx nodpay txs --safe npx nodpay nonce --safe --chain npx nodpay gasprice --chain ``` ### Technical Analysis The Skill instructs the Agent to copy wallet information from the user and substitute it into shell-style commands. The templates do not require strict validation, shell-safe argument passing, or quoting of substituted values. If these commands are constructed as strings and executed through a shell, metacharacters embedded in an attacker-controlled field can be interpreted as shell syntax rather than literal argument data. Relevant characters may include command separators, command substitutions, redirections, pipes, or newline characters. The verification command at line 80 is especially exposed because it processes wallet information before that information has been established as trustworthy. Although Ethereum-style addresses and public keys have narrow valid formats, the Skill does not explicitly instruct the Agent to enforce those formats before executing the commands. The vulnerability is contingent on an implementation that performs textual substitution and invokes a shell. Passing validated arguments directly to a process-executi ...[truncated 1686 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The skill explicitly requires access to ~/.nodpay/.env, which stores the agent signing key, and instructs the runtime to make that file available to the CLI. Any skill or package that can read this file can use or exfiltrate the private key, and in this case the same skill also executes unpinned third-party code, increasing the danger substantially.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

{
    "openclaw":
      {
        "requires": { "bins": ["npx", "curl"], "config": ["~/.nodpay/.env", "~/.nodpay/wallets/"] },
        "homepage": "https://nodpay.ai",
        "install": [{ "id": "node", "kind": "node", "package": "nodpay", "label": "Install NodPay CLI (npm)", "author": "xhyumiracle", "source": "https://github.com/xhyumiracle/nodpay-cli" }]
      },

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The credentials section confirms an agent signing key is stored locally and read at runtime by the CLI process. Even though the text says the key is not passed on the command line or stdout, the design still grants local code execution access to a signing secret, so compromise of the CLI or surrounding environment directly endangers wallet authority.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

"homepage": "https://nodpay.ai",
        "install": [{ "id": "node", "kind": "node", "package": "nodpay", "label": "Install NodPay CLI (npm)", "author": "xhyumiracle", "source": "https://github.com/xhyumiracle/nodpay-cli" }]
      },
    "credentials": "Agent signing key stored in ~/.nodpay/.env (chmod 600, generated by npx nodpay keygen). Read at runtime by CLI process; not passed via CLI args, env vars, or stdout.",
    "persistence": ["~/.nodpay/.env (agent key, chmod 600)", "~/.nodpay/wallets/*.json (wallet info, public key material)"],
    "network": ["nodpay.ai (op-store relay + wallet creation UI)", "Public RPC endpoints via --chain"]
  }

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The persistence section documents long-term storage of the agent key in ~/.nodpay/.env, creating durable local credential exposure. In the context of a financial signing tool, persistent plaintext secret storage materially increases the blast radius of any local compromise or malicious dependency.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

"install": [{ "id": "node", "kind": "node", "package": "nodpay", "label": "Install NodPay CLI (npm)", "author": "xhyumiracle", "source": "https://github.com/xhyumiracle/nodpay-cli" }]
      },
    "credentials": "Agent signing key stored in ~/.nodpay/.env (chmod 600, generated by npx nodpay keygen). Read at runtime by CLI process; not passed via CLI args, env vars, or stdout.",
    "persistence": ["~/.nodpay/.env (agent key, chmod 600)", "~/.nodpay/wallets/*.json (wallet info, public key material)"],
    "network": ["nodpay.ai (op-store relay + wallet creation UI)", "Public RPC endpoints via --chain"]
  }
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The data layout section shows the agent key residing in a predictable file path under the home directory. Predictable, persistent secret locations are a common target for theft, and in this skill they protect a signer involved in blockchain payments, so exposure can translate into fraudulent transaction authorization attempts.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

text

~/.nodpay/
  .env                         # agent key (chmod 600)
  wallets/
    0xAbC...123.json           # one file per wallet

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The skill establishes persistent local state in ~/.nodpay/.env and ~/.nodpay/wallets/, enabling future wallet actions across sessions. Session persistence is not inherently malicious, but in a payments skill it increases risk because sensitive wallet associations and signing capability remain available after the original user interaction, making accidental or unauthorized reuse more likely if the environment is later compromised.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: nodpay
description: Propose on-chain payments from a shared wallet. Use when user asks to send crypto, make a payment, or create a shared wallet.
metadata:
  {
    "openclaw":

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation guidance is broad: 'send crypto, make a payment, or create a shared wallet' can cause the skill to trigger in many financial contexts, including ambiguous requests. In a high-risk domain involving blockchain transactions and key management, overbroad activation increases the chance the agent enters a payment workflow without sufficient user confirmation or contextual safeguards.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

"homepage": "https://nodpay.ai",
        "install": [{ "id": "node", "kind": "node", "package": "nodpay", "label": "Install NodPay CLI (npm)", "author": "xhyumiracle", "source": "https://github.com/xhyumiracle/nodpay-cli" }]
      },
    "credentials": "Agent signing key stored in ~/.nodpay/.env (chmod 600, generated by npx nodpay keygen). Read at runtime by CLI process; not passed via CLI args, env vars, or stdout.",
    "persistence": ["~/.nodpay/.env (agent key, chmod 600)", "~/.nodpay/wallets/*.json (wallet info, public key material)"],
    "network": ["nodpay.ai (op-store relay + wallet creation UI)", "Public RPC endpoints via --chain"]
  }

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

"homepage": "https://nodpay.ai",
        "install": [{ "id": "node", "kind": "node", "package": "nodpay", "label": "Install NodPay CLI (npm)", "author": "xhyumiracle", "source": "https://github.com/xhyumiracle/nodpay-cli" }]
      },
    "credentials": "Agent signing key stored in ~/.nodpay/.env (chmod 600, generated by npx nodpay keygen). Read at runtime by CLI process; not passed via CLI args, env vars, or stdout.",
    "persistence": ["~/.nodpay/.env (agent key, chmod 600)", "~/.nodpay/wallets/*.json (wallet info, public key material)"],
    "network": ["nodpay.ai (op-store relay + wallet creation UI)", "Public RPC endpoints via --chain"]
  }

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

"homepage": "https://nodpay.ai",
        "install": [{ "id": "node", "kind": "node", "package": "nodpay", "label": "Install NodPay CLI (npm)", "author": "xhyumiracle", "source": "https://github.com/xhyumiracle/nodpay-cli" }]
      },
    "credentials": "Agent signing key stored in ~/.nodpay/.env (chmod 600, generated by npx nodpay keygen). Read at runtime by CLI process; not passed via CLI args, env vars, or stdout.",
    "persistence": ["~/.nodpay/.env (agent key, chmod 600)", "~/.nodpay/wallets/*.json (wallet info, public key material)"],
    "network": ["nodpay.ai (op-store relay + wallet creation UI)", "Public RPC endpoints via --chain"]
  }

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill repeatedly instructs the agent to invoke npx nodpay without pinning a package version or integrity hash, which allows whatever version is currently published to npm to execute at runtime. Because this CLI handles signing workflows and reads the agent's key material from ~/.nodpay/.env, a compromised or malicious package update could exfiltrate credentials or alter payment proposals.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Using npx nodpay at setup time fetches and executes an unpinned package from the registry, creating a supply-chain execution path before trust is established. In this skill's context, that package initializes key material, so a malicious update could generate attacker-controlled keys or leak secrets during onboarding.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The wallet-creation and verification flow depends on an unpinned CLI binary fetched via npx, so the exact code being trusted is mutable over time. Since the tool participates in address generation and payment proposal logic, compromise could redirect funds or falsify wallet metadata while appearing legitimate.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Invoking npx nodpay propose without version pinning creates a direct path for arbitrary updated npm code to run during payment proposal generation. In a crypto-payment skill, that is especially sensitive because the command consumes recipient, amount, nonce, and signer metadata that could be tampered with or exfiltrated.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Even read-oriented commands like txs executed through unpinned npx still run arbitrary package code from the registry. An attacker controlling a future package version could leverage these routine calls to harvest wallet identifiers, keys, or environment context and stage later fraud.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The nonce-checking step relies on unpinned remote package execution, so a malicious npm release could spoof nonce information or execute arbitrary code locally. In this workflow, incorrect nonce handling can invalidate or replace pending payments, amplifying the operational risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Calling npx nodpay gasprice without version pinning still exposes the environment to mutable third-party code execution. In this payment skill, manipulated gas estimates could induce underfunding, overspending, or deceptive sweep calculations that affect fund safety.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

text

~/.nodpay/
  .env                         # agent key (chmod 600)
  wallets/
    0xAbC...123.json           # one file per wallet

Static analysis

No suspicious patterns detected.