Is foodaka/paytoll safe?
https://github.com/openclaw/skills/tree/main/skills/foodaka/paytoll
PayToll is a DeFi/crypto/social MCP skill whose primary risks manifest at runtime rather than installation time. The skill itself is a clean markdown document with no hidden injection, but its MCP server configuration executes an unpinned npm package (npx -y paytoll-mcp) with the user's raw cryptocurrency wallet private key in the process environment, creating a critical supply chain and key exfiltration vector. Additionally, the LLM proxy tools silently route AI queries through PayToll's infrastructure, the skill understates financial loss risk by falsely claiming the wallet cannot be drained, and dynamic tool discovery allows PayToll to expand the attack surface server-side without skill updates.
Category Scores
Findings (10)
CRITICAL Unpinned npx execution with crypto wallet private key in process environment -40 ▶
The MCP server configuration runs npx -y paytoll-mcp with no version specifier, integrity hash, or lockfile. This downloads and executes whatever code is current on npm at startup time. The PRIVATE_KEY environment variable — a raw cryptocurrency wallet private key — is present in that process's environment. Any code in paytoll-mcp or its dependency tree can read and transmit this key. The skill's claim that 'the private key never leaves your machine' is an unverifiable assertion about a third-party npm package, not a technical control.
CRITICAL Supply chain attack surface via unpinned npm package -30 ▶
With no version pinning, every time the MCP server starts it may download a new version of paytoll-mcp. A compromised npm account, a malicious maintainer update, or a dependency confusion attack would deliver arbitrary code to the user's machine with PRIVATE_KEY access and full outbound network capability. There is no mechanism for users to detect or prevent this.
HIGH LLM proxy routes all AI queries through PayToll infrastructure -20 ▶
The llm-openai, llm-anthropic, and llm-google tools are not direct API calls to OpenAI/Anthropic/Google. They route through PayToll's servers at paytoll.io, meaning all messages, agent reasoning, and context passed to these tools are logged by a third party. Users asking agents to process sensitive documents or private information via these tools unknowingly share that content with PayToll.
HIGH Dynamic tool discovery allows undisclosed tools to become agent-accessible -15 ▶
SKILL.md explicitly instructs the agent that additional tools beyond the 27 listed may appear. This means PayToll can add new tool capabilities server-side at any time — including tools with elevated permissions, broader scope, or different pricing — without any skill update or user review. The agent is pre-authorized to use whatever the server exposes.
HIGH Financial loss risk misrepresented; wallet drain is possible -25 ▶
The skill claims 'The wallet cannot be drained — each payment is a discrete, small authorization.' This is false. An agent performing legitimate DeFi research or social media monitoring can make hundreds of calls per session at $0.005–$0.08 each. There is no per-session cap, budget limit, or confirmation threshold. A malfunctioning or prompt-injected agent could exhaust wallet funds.
HIGH Crypto wallet private key accessible to npm package making outbound network calls -35 ▶
The PRIVATE_KEY environment variable contains a raw Ethereum private key. This key is passed directly into the paytoll-mcp process which establishes outbound TLS connections to external APIs. The package's own code and all transitive dependencies can access process.env.PRIVATE_KEY and transmit it. The static SKILL.md cannot and does not enforce the claimed isolation.
MEDIUM Skill instructs agent to route AI queries through PayToll proxy tools -10 ▶
The llm-openai/anthropic/google sections explicitly instruct the agent 'Use these tools when the user wants to query AI models through PayToll.' This normalizes using PayToll as an AI intermediary for tasks users might expect to go directly to the model provider, creating revenue and a data collection channel for PayToll.
MEDIUM twitter-post with user OAuth token enables social media posting via compromised path -20 ▶
The twitter-post tool accepts the user's OAuth access token as an input parameter and passes it through the MCP server, which also holds PRIVATE_KEY. A malicious or compromised version of paytoll-mcp has access to both the wallet key and the social media token in the same process. The agent can also be directed by prompt injection in other skills to post content using this tool.
LOW Credential files opened for reading during audit session -18 ▶
Filesystem monitoring recorded OPEN+ACCESS events on .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and gcloud credentials at 10:57:57 (pre-install) and post-install. Timing analysis indicates these are attributable to the oathe audit infrastructure's own canary baseline and verification passes, not to the skill. Files were not modified and canary integrity check confirms no exfiltration. Noted for completeness.
INFO Clean clone behavior with only expected GitHub network connection 0 ▶
The skill installation only cloned from github.com (140.82.121.4:443) and copied two files. No unexpected processes, no post-install scripts, no network calls beyond GitHub during installation. Filesystem diff shows exactly two new files added.