Subly pay

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:25 AM UTC
• Version: 0.2.1

Overview

The skill discloses its payment purpose, but it can automatically spend from a crypto wallet using a downloaded tool that is not pinned to a reviewed version.

Review this carefully before installing. Use only a dedicated, low-balance wallet, keep the payment cap low, confirm every paid URL and price, and prefer a pinned or otherwise verified version of the `@subly_fi/pay` client before allowing wallet-affecting commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:60

Finding

Unpinned Third-Party Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60–118
Vulnerability Type: Insecure runtime dependency execution
Risk Level: High

Vulnerable Code

bash

npx -y @subly_fi/pay setup-link --initial-deposit 1010000
npx -y @subly_fi/pay setup-status <sessionId>
npx -y @subly_fi/pay deposit 1010000
npx -y @subly_fi/pay fetch "<url>"
npx -y @subly_fi/pay fetch "<url>" 100
npx -y @subly_fi/pay fetch "<url>" <sameMaxAmountRawUsdc> apr_<approvalId>
npx -y @subly_fi/pay deposit <amountRawUsdc> [apr_<approvalId>]
npx -y @subly_fi/pay withdraw <amountRawUsdc> [apr_<approvalId>]

Technical Analysis

The Skill directs the Agent to run @subly_fi/pay through npx -y without specifying an exact package version. The -y option suppresses installation confirmation, while the absent version constraint permits npm to resolve and execute a mutable package release at runtime.

Consequently, the code that performs the Skill's security-sensitive operations can differ from the code available when the Skill was reviewed. The project contains no lockfile, integrity hash, vendored implementation, or package source against which the executed payload can be verified.

This dependency is especially sensitive because it runs in an environment configured with SUBLY_DEMO_AGENT_KEYPAIR_PATH and is expected to perform wallet setup, payment, deposit, and withdrawal operations. Although SKILL.md tells the Agent not to disclose the private key, that textual guardrail does not prevent downloaded package code from reading accessible files or environment variables.

Attack Path

1. An attacker compromises the npm package, a package maintainer account, the publication process, or a transitive dependency.
2. The attacker publishes a malicious release that remains resolvable as the package's current version.
3. The Agent follows the Skill and invokes an unversioned npx -y @subly_fi/pay ... command.
4. npx downloads and executes the mutable package without ...[truncated 1186 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace every unversioned invocation with an exact, reviewed version, such as @subly_fi/pay@X.Y.Z.
2. Install dependencies during a controlled build process rather than downloading them when a Skill command is invoked.
3. Commit a lockfile and require package integrity verification using the registry-provided integrity hashes.
4. Vendor the reviewed implementation or include its source in the auditable Skill package where practical.
5. Remove npx -y from security-sensitive runtime workflows so unexpected installation is not silently accepted.
6. Verify package provenance through signed releases, trusted publishing, and a restricted dependency allowlist.
7. Audit both the direct package and its transitive dependency tree before deployment and after upgrades.
8. Run the payment client in a sandbox with narrowly scoped filesystem and network access.
9. Expose only the required key material through a constrained signing interface rather than granting general file access to the private key.
10. Continue using a dedicated, low-value wallet and enforce payment limits independently of the downloaded client.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation text includes broad triggers such as any 402 response, requests to buy/access paid resources, or mentions of Subly/x402/yield-funded payment. This can cause unintended invocation in loosely related conversations and may prompt payment-capable tooling in contexts where the user did not clearly authorize a purchase, increasing the chance of accidental spend attempts or exposure to malicious paywalled URLs.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

envVars:
      - name: SUBLY_DEMO_AGENT_KEYPAIR_PATH
        required: true
        description: Path to the agent wallet keypair JSON (create with solana-keygen). The private key never leaves this file.
      - name: SUBLY_RELAYER_URL
        required: false
        description: Subly relayer API base URL. Defaults to https://api.demo.sublyfi.com.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill repeatedly instructs the agent to execute npx -y @subly_fi/pay without pinning an exact package version or integrity hash. This creates a supply-chain execution risk: a future malicious or compromised package release would be fetched and executed automatically with access to wallet-related environment variables and the local keypair path, enabling theft or unauthorized payments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This command uses an unpinned npx package for payment-related actions. Because npx resolves and executes the latest matching package at runtime, a malicious update or dependency compromise could run arbitrary code in a sensitive context tied to Solana wallet operations and payment approval flows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Invoking npx -y @subly_fi/pay without version pinning exposes the agent to arbitrary code execution through upstream package substitution or compromised releases. In this skill, the danger is elevated because the executed tool governs paid fetches and interacts with a wallet keypair path and financial relayer endpoints.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill tells the agent to run an unpinned remote package as part of setup-status, again allowing whatever version is currently published to execute locally. A compromised package could falsify status handling, exfiltrate environment data, or manipulate later payment and approval behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This deposit invocation executes an unpinned package in a highly sensitive financial workflow. If the package or one of its dependencies is compromised, it could trigger unauthorized wallet actions, tamper with deposit behavior, or exfiltrate secrets needed for later attacks.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The fetch retry command is another unpinned npx execution path, so the approval flow can be subverted by a package compromise at the exact point where higher-value or exceptional transactions are retried. This increases risk because operators may trust the retry command after a legitimate approval event.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The deposit command in the deposits/withdrawals section again relies on a floating package reference. Because this skill controls movement of principal into a DeFi vault, arbitrary code execution through package takeover could directly cause financial loss or unauthorized transaction orchestration.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The withdraw command also executes an unpinned package, exposing withdrawal operations to supply-chain compromise. In the context of a wallet-management skill, this can enable theft, deception in approval UX, or malicious changes to fund movement logic.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.