Agent Payment Rail

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:09 PM UTC
• Version: 1.0.0

Overview

This payment skill is coherent, but it exposes real money-moving actions without enough documented confirmation, limits, or install safeguards.

Review carefully before installing. Use sandbox/test keys first, pin and verify the npm package version, avoid global installation where possible, use least-privilege payment-provider credentials, and require explicit human approval for payment creation, refunds, and cancellations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: readme.md:41

Finding

Unpinned External Package Receives Payment Provider Credentials

Content

View full analysis

Vulnerability Details

File Location: readme.md:41-60, readme.md:102; duplicated in skill.md:99-124
Vulnerability Type: Unverified and unpinned third-party dependency
Risk Level: Medium

The documentation instructs users to install an external npm package without pinning an exact version, providing a lockfile, or supplying integrity verification. The application then passes a Stripe API key to code whose implementation is absent from this project.

Relevant code from readme.md:41-60:

bash

npm install openclaw-agent-payment-rail

bash

export STRIPE_API_KEY="sk_test_..."

typescript

import { PaymentRail } from 'openclaw-agent-payment-rail';

const rail = new PaymentRail();

// Initialize
await rail.initialize({
  provider: 'stripe',
  apiKey: process.env.STRIPE_API_KEY,
});

The README also recommends a global installation at readme.md:102:

bash

npm install -g openclaw-agent-payment-rail

Equivalent instructions appear in skill.md:99-124:

bash

npm install openclaw-agent-payment-rail

bash

# Stripe
export STRIPE_API_KEY="sk_test_..."

# PayPal (coming soon)
export PAYPAL_CLIENT_ID="..."
export PAYPAL_CLIENT_SECRET="..."

typescript

import { PaymentRail } from 'openclaw-agent-payment-rail';

const rail = new PaymentRail();

await rail.initialize({
  provider: 'stripe',
  apiKey: process.env.STRIPE_API_KEY,
});

Technical Analysis

The artifact contains only documentation and does not include the implementation of the advertised payment operations. All substantive functionality is delegated to openclaw-agent-payment-rail.

The installation command does not pin an exact version. npm may therefore resolve a later release than the one originally reviewed. The artifact also provides no lockfile, package integrity hash, vendored source, signed provenance, or checksum through which users can verify the installed implementation. npm packages may execute lifecycle scripts during installation ...[truncated 2228 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact reviewed version rather than allowing npm to select the latest compatible release.
2. Commit a lockfile containing npm integrity metadata and require reproducible, lockfile-enforced installation such as npm ci.
3. Include or vendor the implementation source in the audited artifact so payment and credential-handling behavior can be reviewed.
4. Publish and verify release provenance, signatures, or cryptographic checksums for the approved package.
5. Avoid recommending global installation unless the CLI is essential. Prefer a project-local dependency invoked through a pinned script.
6. Where compatible, install with lifecycle scripts disabled and explicitly review any scripts before enabling them.
7. Use restricted payment-provider credentials with only the permissions required for the documented operations.
8. Use test-mode keys during development, isolate production credentials, rotate keys regularly, and revoke them immediately after suspected dependency compromise.
9. Run payment integrations in a constrained service account or container with minimal filesystem access, restricted outbound networking, and no unrelated secrets in its environment.
10. Add dependency monitoring and require security review before updating the approved package version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The CLI examples present direct pay, status, and refund commands as routine usage without warning whether they operate against live accounts or can trigger irreversible financial effects. Because users may copy-paste these commands, especially in agent or automation setups, the examples normalize real-money operations without confirmation, increasing the chance of accidental charges or refunds.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README advertises payment, refund, and cancellation operations for agent use without any explicit warning that these actions can move real funds and should require human confirmation or strong authorization. In an agent context, documentation strongly shapes default integrations, so omission of transaction-safety guidance increases the risk of developers exposing financially sensitive actions to autonomous execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill exposes payment, refund, and cancellation capabilities as simple tool calls without any documented requirement for user confirmation, authorization checks, spending limits, or warnings that these actions can move money or irreversibly alter transactions. In an agent context, this increases the risk of accidental or prompt-induced financial actions, especially because the examples normalize direct execution of sensitive operations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.