Security audit

MagicPay

Security checks across malware telemetry and agentic risk

Overview

This payment automation skill is mostly coherent, but it combines high-impact payment and protected-data authority with broad activation and hidden comment-based command automation that users should review carefully.

Install only if you intend to let MagicPay manage payment, checkout, login, identity, and saved Memory workflows and you trust the npm CLI it installs. Before use, review the hidden continuation comments and ensure your runtime validates returned commands against the current MagicPay session and approved action. Keep MAGICPAY_API_KEY, local config files, CDP endpoints, OTPs, and Memory values private; approve payments only when the amount, currency, recipient, recurring status, and country are exact.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill advertises very broad activation criteria such as any task involving protected Memory, payment operations, or approval. In an agent system, that can cause the skill to activate on loosely related tasks and steer execution into sensitive payment or identity workflows unnecessarily, increasing the chance of over-privileged behavior or unsafe tool routing.

Hidden Instructions

High

Category: Prompt Injection
Content: `memoryReady: true`, run exactly its returned `resumeCommand`.  Run exactly the returned `pollCommand` before exactly the returned `resumeCommand`.  - For `pendingAction.action: "chat_question"`, ask exactly its `question`, then send the answer only through stdin to the exact returned `replyCommand`; never put it in argv, print it, or construct `--decision-json`. The command maps, submits with `save:false`, claims, and resumes. - For `memory_confirmation`, ask its `question` and run exactly the returned `allowCommand` or `denyCommand`. For `memory_choice`, show only its safe labels and run the exact command attached to the chosen label. - Payment-card availability never uses Memory. For `nextAction: "authorize-payment"`,
Confidence: 76% confidence
Finding:  - For `pendingAction.action: "chat_question"`, ask exactly its `question`, then send the answer only through stdin to the exact returned `replyCommand`; never put

Hidden Instructions

High

Category: Prompt Injection
Content: # MagicPay Command Guide  ## Contents - [Setup And Readiness](#setup-and-readiness)
Confidence: 97% confidence
Finding:  ## Contents - [Setup And Readiness](#setup-and-readiness) - [Native Payment Operations](#native-payment-operations) - [MagicSearch Discovery](#magicsearch-d

Hidden Instructions

High

Category: Prompt Injection
Content:  Immediately run the exact returned `pendingRequest.pollCommand` and remain attached to that process.  ### `magicpay x402-purchase-result --operation-id <operationId>`
Confidence: 97% confidence
Finding:  ### `magicpay x402-purchase-result --operation-id <operationId>` Read the paid resource only after that same operation is terminal `completed`. An approval, HTTP r

Hidden Instructions

High

Category: Prompt Injection
Content:  Run exactly the returned `pollCommand` before exactly the returned `resumeCommand`.  ### `magicpay delete-memory-field --field-ref <fieldRef>`
Confidence: 96% confidence
Finding:  ### `magicpay delete-memory-field --field-ref <fieldRef>` Remove one existing editable field by stable `fieldRef`: ```bash magicpay delete-memory-field --field-re

Hidden Instructions

High

Category: Prompt Injection
Content: # MagicPay Setup  ## Contents
Confidence: 90% confidence
Finding:  ## Contents - [Setup Instructions](#setup-instructions) - [First-Time Landing Setup](#first-time-landing-setup) - [UI Connect Setup](#ui-connect-setup) ##

Hidden Instructions

High

Category: Prompt Injection
Content:  After `magicpay plan-fill`, execute its exact returned `applyCommand`.  Success shape:
Confidence: 84% confidence
Finding:  Success shape: ```json { "success": true, "plan": { "id": "plan_123", "valueVisibility": "handles_only", "fields": [] }, "nextAction": "apply-f

Hidden Instructions

High

Category: Prompt Injection
Content: # MagicPay Operating Guide  ## Contents - [One User-Request Loop](#one-user-request-loop)
Confidence: 95% confidence
Finding:  ## Contents - [One User-Request Loop](#one-user-request-loop) - [Runtime Routing Details](#runtime-routing-details) - [Preflight And CLI Health](#preflight-

Hidden Instructions

High

Category: Prompt Injection
Content:  Immediately run the exact returned `pollCommand` and remain attached to that process.  The loop is always:
Confidence: 95% confidence
Finding:  The loop is always: ```text share link -> run exact returned pollCommand now -> keep that process -> pending/interrupted means run exact returned pollCommand again

Hidden Instructions

High

Category: Prompt Injection
Content:  Immediately run the exact returned `pendingRequest.pollCommand` and remain attached to that process.  ## Preflight And CLI Health
Confidence: 95% confidence
Finding:  ## Preflight And CLI Health Before the first MagicPay task in a session, run `magicpay status` and handle the output: - **Missing or invalid API key.** Ask the us

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

View on VirusTotal

Static analysis

No suspicious patterns detected.