aws/agent-toolkit-for-aws agents-pay

Checked the catalogued skill at agents-pay.

SkillTrust corpus scan 22 September 2026 v0.10.0 via skillsh Verify on GitHub

F AI-triaged 59

D Security

D set by findings not listed

F Permissions

F set by findings not listed

B Transparency

B; retained sample includes a medium finding · SD-007 · what this rule accepts as a false positive →

showing 10 of 59

transparencymedium SD-007

packages/openclaw/package-lock.json

transparencymedium SD-007

packages/openclaw/package-lock.json

transparencymedium SD-007

packages/openclaw/package-lock.json

transparencymedium SD-007

packages/openclaw/package-lock.json

transparencymedium SD-007

packages/openclaw/package-lock.json

transparencymedium SD-007

packages/openclaw/package-lock.json

transparencymedium SD-007

packages/openclaw/package-lock.json

transparencymedium SD-007

packages/openclaw/package-lock.json

transparencymedium SD-007

packages/openclaw/package-lock.json

transparencymedium SD-007

packages/openclaw/package-lock.json

6 suppressed by AI triage

permission_hygienehigh SD-003 benign_example

SKILL.md

Documentation notes potential path traversal but no actual use in code.

permission_hygienehigh SD-003 benign_example

packages/openclaw/skills/agents-pay/SKILL.md

Documentation notes potential path traversal but no actual use in code.

permission_hygienecritical SD-006 benign_example

packages/openclaw/src/payments.ts

The value is derived from a function and not a hardcoded string, so it is not a secret

securityhigh SD-007 benign_example

references/setup.md

Documentation shows a harmless curl command for retrieving merchant info, not malicious.

securitymedium SD-008 benign_example

references/setup.md

Base64 decoding used in documentation to parse a response header, benign.

securitymedium SD-008 benign_example

scripts/x402_fetch.py

The base64 decoding is used to process a header value that may legitimately be base64 encoded, not an obfuscated payload.