USDC Escrow

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:30 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward escrow API wrapper, but its financial actions are under-scoped and its trust model is not clearly disclosed.

Review before installing. Use it only if you trust api.payclawback.xyz and understand whether you are operating on Base Sepolia testnet or any real-value backend configured through ESCROW_API_URL. Require explicit human approval for create, release, dispute, resolve, and claim-expired actions, and verify escrow IDs, recipients, amounts, network, and contract details before running commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill exposes shell-based operational capabilities through documented scripts but does not declare corresponding permissions or capability expectations. In an agent environment, this can bypass operator understanding of what the skill is allowed to do, increasing the chance of unintended command execution or unsafe invocation of external tooling.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The documented capability set materially exceeds the skill's stated scope by including dispute resolution, expired-claim, broad escrow enumeration, stats, and event streaming. For a financial skill, hidden or under-declared capabilities can mislead integrators and users into granting trust to an agent that can access more operational or sensitive actions than expected.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The documentation labels the system 'trustless' while simultaneously stating that a server wallet approves spending, creates escrows, and is the exclusive arbiter for dispute resolution. This is a dangerous trust-boundary misrepresentation in a payments context because users may assume on-chain minimization of trust when, in fact, a centralized operator can control critical fund flows and dispute outcomes.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation instructs agents to create, release, dispute, and resolve USDC escrows without an explicit warning that these actions can move real funds and may be irreversible once submitted on-chain. In this context, the danger is elevated because the entire skill is purpose-built for financial transactions, so omission of strong confirmation and risk language makes accidental or unauthorized fund movement more likely.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The release endpoint moves escrowed funds on-chain yet the documentation does not prominently warn that the action is irreversible and financially consequential. In an agent-to-agent payment setting, missing confirmation language increases the chance of accidental or socially engineered fund release by operators or automated systems.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: Dispute resolution and expired-claim operations change blockchain state and can permanently redirect or recover funds, but the documentation does not present them with high-friction warnings or explicit user-consent requirements. In a financial automation context, that omission raises the risk of accidental, premature, or manipulated execution of sensitive actions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script triggers a state-changing dispute action immediately against the escrow API using only a positional escrow ID and provides no confirmation prompt, dry-run mode, or explicit warning to the operator. In an escrow/payment context, opening a dispute is a sensitive action that can interrupt settlement, create operational friction, and be invoked accidentally or by higher-level agents without adequate user awareness.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script performs a state-changing release of escrowed funds immediately after receiving an escrow ID, with no interactive confirmation, dry-run mode, or secondary validation. In the context of a payment escrow skill, this increases the chance of accidental or automated unauthorized fund release due to operator error, bad input propagation, or misuse by another agent invoking the script.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: This script performs an irreversible dispute-resolution action immediately from positional arguments, with no confirmation prompt, dry-run mode, or secondary verification. In an escrow context, accidental invocation, argument mix-ups, or automation errors can directly misdirect funds to the wrong party or incorrectly refund a disputed payment.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.