paypilot
Facilitates payment processing, invoicing, and fraud detection through a secure API, enhancing transaction management for businesses.
Install this skill
Security score
The paypilot skill was audited on Feb 28, 2026 and we found 25 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Curl to non-GitHub URL
| 39 | curl -s "https://paypilot.agms.com/v1/auth/register" -X POST \ |
Curl to non-GitHub URL
| 46 | curl -s "https://paypilot.agms.com/v1/auth/login" -X POST \ |
Curl to non-GitHub URL
| 53 | curl -s "https://paypilot.agms.com/v1/auth/configure" -X POST \ |
Curl to non-GitHub URL
| 83 | curl -s "https://paypilot.agms.com/v1/onboard" -X POST \ |
Access to hidden dotfiles in home directory
| 18 | path: ~/.config/paypilot/config.json |
Access to hidden dotfiles in home directory
| 32 | cat ~/.config/paypilot/config.json |
Access to hidden dotfiles in home directory
| 61 | mkdir -p ~/.config/paypilot |
Access to hidden dotfiles in home directory
| 62 | cat > ~/.config/paypilot/config.json << 'EOF' |
Access to hidden dotfiles in home directory
| 69 | chmod 600 ~/.config/paypilot/config.json |
Access to hidden dotfiles in home directory
| 100 | CONFIG=$(cat ~/.config/paypilot/config.json) |
Access to hidden dotfiles in home directory
| 117 | jq --arg t "$NEW_TOKEN" '.token = $t' ~/.config/paypilot/config.json > /tmp/pp.json && mv /tmp/pp.json ~/.config/paypilot/config.json |
Access to hidden dotfiles in home directory
| 118 | chmod 600 ~/.config/paypilot/config.json |
External URL reference
| 4 | homepage: https://agms.com/paypilot/ |
External URL reference
| 29 | PayPilot connects to a hosted API proxy at `https://paypilot.agms.com`. On first use, check for credentials: |
External URL reference
| 39 | curl -s "https://paypilot.agms.com/v1/auth/register" -X POST \ |
External URL reference
| 46 | curl -s "https://paypilot.agms.com/v1/auth/login" -X POST \ |
External URL reference
| 53 | curl -s "https://paypilot.agms.com/v1/auth/configure" -X POST \ |
External URL reference
| 64 | "api_url": "https://paypilot.agms.com", |
External URL reference
| 83 | curl -s "https://paypilot.agms.com/v1/onboard" -X POST \ |
External URL reference
| 89 | > "Great! To finish your application, complete the form here: **https://agms.com/get-started/** |
External URL reference
| 272 | - **OpenAPI Spec:** `https://paypilot.agms.com/openapi.json` |
External URL reference
| 273 | - **AI Plugin Manifest:** `https://paypilot.agms.com/.well-known/ai-plugin.json` |
External URL reference
| 274 | - **LLM Resource Index:** `https://paypilot.agms.com/llms.txt` |
External URL reference
| 275 | - **Landing Page:** `https://agms.com/paypilot/` |
External URL reference
| 276 | - **ClawHub:** `https://clawhub.ai/agmsyumet/paypilot-agms` |