mayar-v2

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt tells the agent to request/set an API key and even shows a CLI form npx -y mayar@latest api-key <key> (a direct command-line argument), which would require the LLM to handle or emit the secret verbatim — an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow ingests outsider-authored free text via the externally-sent Mayar webhook HTTP payload (e.g., app/api/webhooks/mayar/route.ts / _pattern.md webhook handler reads req.json() and uses payload.data.id before re-fetching), which is attacker-controlled at the network boundary even though it re-fetches status from the Mayar API.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill repeatedly requires running the CLI via "npx -y mayar@latest" which fetches and executes the latest remote npm package at runtime (executes remote code) and is used as a required dependency for CLI/docs/webhook registration.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). Yes. The skill is explicitly a payment integration for the "Mayar" payment gateway: it requires/sets API keys, documents calls like create-payment-link / create-invoice / create-membership, instructs creating server endpoints to call the Mayar API, handling webhooks, re-fetching transaction status, registering webhooks, and contains the gateway base URLs. These are specific financial execution operations (creating payment links/invoices, verifying and provisioning after paid), not generic tooling.