nextpay
Fail
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill setup requires executing a shell script downloaded from 'https://new.nextpay.world/cli/install.sh' and piping it directly into the shell ('| sh'). This execution pattern is highly dangerous as it grants the remote script full execution privileges on the host system without any integrity or authenticity checks.
- [EXTERNAL_DOWNLOADS]: The skill initiates downloads from an external domain ('nextpay.world') that is not identified as a trusted or well-known source. It also utilizes 'npx' to fetch and run external packages from the registry.
- [CREDENTIALS_UNSAFE]: The documentation points to '~/.nextpay/credentials.json' as the location where sensitive session information is stored. Disclosing the path of local credential storage is a security concern as it can be targeted for data harvesting.
- [COMMAND_EXECUTION]: The skill relies extensively on shell command execution for installation, authentication, and management tasks, which increases the risk of command injection and unauthorized system modification.
Recommendations
- HIGH: Downloads and executes remote code from: https://new.nextpay.world/cli/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata