walletconnect-pay-headless

Fail

Audited by Gen Agent Trust Hub on Aug 3, 2026

Risk Level: CRITICALEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs users to download and install official npm packages from the vendor, including @walletconnect/pay-core, @walletconnect/pay-state, @walletconnect/pay-appkit, and @walletconnect/pay-react. These are legitimate dependencies for the stated purpose of the skill.
  • [DATA_EXFILTRATION]: The skill identifies a data exposure risk where secret API keys could be leaked to the browser. It mitigates this by enforcing a server-side proxy architecture, using @walletconnect/pay-core/server for authenticated requests and standard environment variable management for secrets.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) as it ingests untrusted data from the WalletConnect Engine API (e.g., payment intent details and KYC field definitions in snapshot.collectData.fields).
  • Ingestion points: External data enters the agent context through the proxy server described in references/server-proxy.md and the snapshot states in SKILL.md.
  • Boundary markers: The skill does not explicitly define boundary markers for the data returned by the Engine API.
  • Capability inventory: The skill has the capability to trigger wallet signatures (confirmSelection) and perform network operations via the Transport seam.
  • Sanitization: The skill assumes the SDK handles sanitization; it does not provide instructions for additional validation of data received from the payment engine.
Recommendations
  • Contains 4 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Aug 3, 2026, 08:58 AM
Security Audit — agent-trust-hub — walletconnect-pay-headless