@arispay/skill: Suspicious npm security report (Warn)

Loading npm security reports…

Source & flagged code

2 flagged

skill/scripts/pay.mjsView file

Lines 7-47javascript

7 * directly (that's the PRIORITY DIRECTIVE in SKILL.md). This script exists

8 * only as a fallback for agents that require a local `scripts/<name>.mjs`

9 * entry point — it spawns the CLI, streams stderr to the caller so

10 * verification / funding URLs reach the user in real time, and writes the

11 * final HTTP body to stdout.

12 *

13 * Intentionally does NOT maintain local state. `payagent` owns its state at

14 * `~/.payagent/config.json`. Any extra state file in this directory is a

15 * bug.

16 *

17 * Usage:

18 * node pay.mjs <url> [--agent NAME] [--per-tx N] [--daily N] [--monthly N]

19 * [--network base|base-sepolia|ethereum|polygon]

20 * [--domains CSV] [--method GET|POST|...] [--body STRING]

21 * [--amount N]

22 *

23 * All flags are forwarded verbatim to `payagent pay`. Exit code is the CLI's

24 * exit code, so the caller can distinguish success (0) from any kind of

25 * failure (non-zero) without parsing stderr.

26 */

28import { spawn } from "node:child_process";

High

Child Process

Package source references child process execution.

skill/scripts/pay.mjsView on unpkg · L27

30const args = process.argv.slice(2);

31if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {

32 console.error("Usage: pay.mjs <url> [payagent pay flags]");

33 console.error("");

34 console.error("This is a thin wrapper around `npx payagent pay`. See:");

35 console.error(" npx payagent pay --help");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

skill/scripts/pay.mjsView on unpkg · L27

36 process.exit(args.length === 0 ? 1 : 0);

37}

39const child = spawn("npx", ["-y", "payagent", "pay", ...args], {

40 stdio: "inherit",

41});

43child.on("error", (err) => {

44 console.error(`pay.mjs: failed to spawn \`npx payagent pay\` — ${err.message}`);

45 console.error("Is Node.js installed and on PATH?");

46 process.exit(127);

47});

Source & flagged code

2 flagged · loading source

skill/scripts/pay.mjsView file

27L28: import { spawn } from "node:child_process"; L29:

High

Child Process

Package source references child process execution.

skill/scripts/pay.mjsView on unpkg · L27

27L28: import { spawn } from "node:child_process"; L29: ... L33: console.error(""); L34: console.error("This is a thin wrapper around `npx payagent pay`. See:"); L35: console.error(" npx payagent pay --help");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

skill/scripts/pay.mjsView on unpkg · L27

@arispay/skill: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

2 flagged

skill/scripts/pay.mjsView file

Lines 7-47javascript

7 * directly (that's the PRIORITY DIRECTIVE in SKILL.md). This script exists

8 * only as a fallback for agents that require a local `scripts/<name>.mjs`

9 * entry point — it spawns the CLI, streams stderr to the caller so

10 * verification / funding URLs reach the user in real time, and writes the

11 * final HTTP body to stdout.

12 *

13 * Intentionally does NOT maintain local state. `payagent` owns its state at

14 * `~/.payagent/config.json`. Any extra state file in this directory is a

15 * bug.

16 *

17 * Usage:

18 * node pay.mjs <url> [--agent NAME] [--per-tx N] [--daily N] [--monthly N]

19 * [--network base|base-sepolia|ethereum|polygon]

20 * [--domains CSV] [--method GET|POST|...] [--body STRING]

21 * [--amount N]

22 *

23 * All flags are forwarded verbatim to `payagent pay`. Exit code is the CLI's

24 * exit code, so the caller can distinguish success (0) from any kind of

25 * failure (non-zero) without parsing stderr.

26 */

28import { spawn } from "node:child_process";

High

Child Process

Package source references child process execution.

skill/scripts/pay.mjsView on unpkg · L27

30const args = process.argv.slice(2);

31if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {

32 console.error("Usage: pay.mjs <url> [payagent pay flags]");

33 console.error("");

34 console.error("This is a thin wrapper around `npx payagent pay`. See:");

35 console.error(" npx payagent pay --help");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

skill/scripts/pay.mjsView on unpkg · L27

36 process.exit(args.length === 0 ? 1 : 0);

37}

39const child = spawn("npx", ["-y", "payagent", "pay", ...args], {

40 stdio: "inherit",

41});

43child.on("error", (err) => {

44 console.error(`pay.mjs: failed to spawn \`npx payagent pay\` — ${err.message}`);

45 console.error("Is Node.js installed and on PATH?");

46 process.exit(127);

47});

@arispay/skill

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Runtime surface

Behavioral surface

Source & flagged code