CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

26.6 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 2 flagged

Securityscore 76 · 2 findings

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · skills/claude/synapse-agentpay/SKILL.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptskills/claude/synapse-agentpay/SKILL.md· markdown

49- On `PRICE_MISMATCH`, rediscover and retry only if the task still permits the current price

… (1 chars elided on L49)

50- On insufficient balance, budget, invalid credential, or forbidden receipt errors, stop and

… (42 chars elided on L50)

51- Never ask for owner private keys, seed phrases, owner JWTs, provider secrets, admin creden

… (90 chars elided on L51)

53## When Writing Code Or Docs

Occurrences

1 occurrence · at L51

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha2565084aa178cfd9d97…rubric 365aacaView on GitHub

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · SECURITY.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The exact value spotted

excerptSECURITY.md· markdown

19```

21It must never ask for or handle owner private keys, seed phrases, owner JWTs, provider secre

… (108 chars elided on L21)

23Gateway enforces credential ownership, pricing validation, settlement, budgets, risk checks,

… (73 chars elided on L23)

Occurrences

1 occurrence · at L21

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25614b7852251bf4666…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/claude/synapse-agentpay/SKILL.md · 1 file

skills/claude/synapse-agentpay/SKILL.md2.3 KB · Markdown

name: synapse-agentpay

description: Use this skill when a user wants an AI agent to discover paid APIs, invoke services through SynapseNetwork, pay with USDC micropayments, or retrieve receipts using the Synapse Network MCP Server.

SynapseNetwork AgentPay Skill

Use the official Synapse Network MCP Server when the user asks to connect an agent to paid APIs, API monetization, AgentPay, service discovery, USDC micropayments, or auditable receipts.

MCP Configuration

For production workflows, configure the MCP server with production environment variables:

{
  "mcpServers": {
    "synapse-agentpay": {
      "command": "npx",
      "args": ["-y", "@synapse-network-ai/mcp-server"],
      "env": {
        "SYNAPSE_AGENT_KEY": "agt_xxx",
        "SYNAPSE_ENV": "prod"
      }
    }
  }
}

Do not generate staging configuration unless the user explicitly asks for preview or E2E validation.

Runtime Workflow

Use exactly this MCP tool workflow:

discover_services -> invoke_and_pay -> get_receipt

Call discover_services with the user's service intent.
Select an appropriate service and preserve the price string from discovery.
For fixed-price APIs, call invoke_and_pay with service_id, payload, exact costUsdc, and a stable idempotencyKey.
For token-metered services, omit costUsdc and pass maxCostUsdc as a string budget cap when needed.
Call get_receipt with the returned invocation_id and inspect the status and charged amount.

Critical Rules

Keep all money values as strings. Never use floating-point math for USDC decisions.
Treat the MCP server as stateless. It does not remember prices from discovery.
On PRICE_MISMATCH, rediscover and retry only if the task still permits the current price.
On insufficient balance, budget, invalid credential, or forbidden receipt errors, stop and ask the owner to fix the Agent Key state.
Never ask for owner private keys, seed phrases, owner JWTs, provider secrets, admin credentials, deposits, withdrawals, refunds, settlement controls, or provider setup permissions.

When Writing Code Or Docs

Prefer MCP configuration snippets over SDK code when the user wants agent runtime integration. Use Synapse SDK docs only when the user is building application code outside MCP.

synapse-agentpay-0bce69— agent skill

Is synapse-agentpay-0bce69 safe to install?

SynapseNetwork AgentPay Skill

MCP Configuration

Runtime Workflow

Critical Rules

When Writing Code Or Docs

Audit the pieces. Scan the whole. Decide.