Pay For Service

• Analyzed: May 12, 2026, 3:52 AM
• Findings: 1
• Version: 0.1.0
• Hash: 7ffdf8a56b293a7f478f52625ab4044bceb5b5dd70c869700a85af7310acc42a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is suspicious due to a high risk of shell injection and potential financial loss. The `SKILL.md` explicitly allows the agent to execute `npx awal@latest x402 pay` with arbitrary arguments via `Bash`. This command takes user-controlled inputs (URL, data, headers, query parameters) which, if not properly sanitized and shell-escaped by the agent, could lead to arbitrary command execution (RCE). The skill also involves making USDC payments, introducing a financial risk if the agent is prompted to make unauthorized or excessive transactions.