aifinpay-agent

v0.3.0a0 suspicious
4.0
Medium Risk

Unified agent-economy SDK for autonomous AI agents — chain-opaque AiFinPayAgent surface (call/balance/verify) over Polygon and Solana execution environments. Non-custodial, x402-native.

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package has moderate risks due to potential obfuscation and incomplete maintainer metadata, raising concerns about its legitimacy.

  • Moderate obfuscation risk
  • Incomplete maintainer metadata
Per-check LLM notes
  • Network: The package makes network calls which appear to be for registry updates and RPC requests, suggesting it's designed to interact with external services, likely within its intended functionality.
  • Shell: No shell execution patterns were detected.
  • Obfuscation: The use of base64 decoding might indicate an attempt to hide code or data, but it could also be used for legitimate purposes such as data encryption.
  • Credentials: No clear patterns indicative of credential harvesting were found.
  • Metadata: The maintainer's author information is incomplete, and the account seems new or inactive, which raises some suspicion but not enough to conclusively label it as malicious.

📦 Package Quality Overall: Medium (5.0/10)

◈ Medium Test Suite 6.0

Partial test coverage signals detected

  • 1 test file(s) detected (e.g. test_facilitators.py)
◈ Medium Documentation 7.0

Some documentation present

  • Documentation URL: "Documentation" -> https://aifinpay.company/docs
  • Detailed PyPI description (3049 chars)
○ Low Contributing Guide 2.0

No contributing guide or governance files found

  • No CONTRIBUTING, CODE_OF_CONDUCT, or governance files found
◈ Medium Type Annotations 5.0

Partial type annotation coverage

  • 34 type-annotated function signatures detected in source
◈ Medium Multiple Contributors 5.0

Limited contributor diversity

  • 1 unique contributor(s) across 43 commits in AiFinPay/sdk
  • Single author but highly active (43 commits)

🔬 Heuristic Checks

⚠ Outbound Network Calls score 4.5

Found 3 network call pattern(s)

  • meout self._session = requests.Session() self._session.headers["User-Agent"] = "aifinpay-ag
  • f._registry_cache r = requests.get(self.registry_url, timeout=10) r.raise_for_status()
  • rpc_req = lambda payload: requests.post(self.solana_rpc, json=payload, timeout=timeout).json()
⚠ Code Obfuscation score 2.0

Found 1 obfuscation pattern(s)

  • ) try: decoded = base64.b64decode(raw).decode("utf-8") except Exception as e: rais
✓ Shell / Subprocess Execution

No shell execution patterns detected

✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: aifinpay.company>

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

Repository AiFinPay/sdk appears legitimate

⚠ Maintainer History score 4.0

2 maintainer concern(s) found

  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with aifinpay-agent 
Create a fully-functional mini-app called 'AI Wallet Manager' which leverages the 'aifinpay-agent' Python package to manage AI agents' finances across Polygon and Solana blockchains. The app should allow users to perform the following actions:

1. **Register New Agent**: Users can register a new autonomous AI agent by providing a unique identifier. The app will use the 'aifinpay-agent' package to create a new wallet for the agent on both Polygon and Solana.

2. **Check Balance**: Users can check the balance of their registered AI agents. The app should fetch and display the current balance from both blockchains using the 'balance' function provided by the 'aifinpay-agent' package.

3. **Transfer Funds**: Users can transfer funds between different AI agents within the same blockchain or cross-chain between Polygon and Solana. The 'aifinpay-agent' package's 'call' function should be used to execute these transactions.

4. **Verify Transactions**: Users can verify the status of any transaction made through the app. This feature will utilize the 'verify' function from the 'aifinpay-agent' package to confirm if a transaction was successful.

5. **Transaction History**: Provide a history of all transactions performed by the user’s AI agents. This feature should store and display all transaction details including sender, receiver, amount, and timestamp.

The 'aifinpay-agent' package ensures that the app operates in a non-custodial environment, meaning that users retain full control over their assets without the need for intermediaries. Additionally, the app should support x402-native operations, enhancing the interoperability between different financial systems.

To make the project more engaging, consider adding a dashboard where users can visualize their AI agents' financial activities, and include a feature that allows users to set up automatic transfers based on certain conditions (e.g., when a specific balance threshold is reached).

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!