Monetize Service

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:35 PM UTC
• Version: 0.1.0

Overview

The skill is a coherent guide for building a paid x402 API, but it needs Review because it combines real-money payment flows with broad shell permissions and unpinned executable npm tooling.

Review before installing. Use a sandbox, prefer base-sepolia for testing, pin exact package versions, verify the payment recipient address independently, and require explicit user confirmation before any command that can spend funds or use wallet/CDP credentials.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:24

Finding

Unpinned Third-Party Package Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:24
Vulnerability Type: Supply-chain exposure through unpinned executable dependencies
Risk Level: High

bash

npx awal@latest status

Related unpinned commands also appear at SKILL.md:30, SKILL.md:38, SKILL.md:215, SKILL.md:240, and SKILL.md:243:

bash

npx awal@latest address
npm install express x402-express
npm install @coinbase/x402
npx awal@latest x402 details http://localhost:3000/api/example
npx awal@latest x402 pay http://localhost:3000/api/example

Technical Analysis

The skill directs the agent to retrieve and execute the latest release of the awal npm package. The effective code can therefore change after the skill has been reviewed. The other installation commands also omit exact versions, lockfile enforcement, and integrity or provenance validation.

npx can download a missing package and execute its entry point. npm installation can also execute package lifecycle scripts. Consequently, compromise of a referenced package, maintainer account, transitive dependency, or package-distribution channel could result in arbitrary code running with the privileges of the user invoking the skill.

Attack Path

1. An attacker compromises a referenced npm package, its publishing account, or one of its transitive dependencies.
2. The attacker publishes a malicious version that becomes the version selected by @latest or an unconstrained installation.
3. A user or agent follows the skill and runs the documented npx or npm install command.
4. npm downloads the malicious package and executes its command entry point or lifecycle script.
5. The malicious code runs under the invoking user's account and can access resources available to that account.

Impact Assessment

Successful exploitation can provide arbitrary code execution with the invoking user's privileges. The potential scope includes reading or modifying a ...[truncated 313 chars]

Remediation

View remediation

Remediation Suggestions

• Replace npx awal@latest with an exact, reviewed version.
• Pin exact versions of express, x402-express, and @coinbase/x402.
• Generate and commit a lockfile, then use npm ci rather than unconstrained installation.
• Verify registry provenance, package ownership, published checksums, and integrity metadata before execution.
• Review direct and transitive dependencies and monitor them for compromise or unexpected ownership changes.
• Where feasible, disable package lifecycle scripts during installation and explicitly permit only reviewed scripts.
• Execute payment and wallet tooling in an isolated, least-privileged environment without unrelated credentials.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:5

Finding

Overly Broad Shell Tool Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5
Vulnerability Type: Excessive command-execution and network permissions
Risk Level: High

yaml

allowed-tools: ["Bash(npx awal@latest status*)", "Bash(npx awal@latest address*)", "Bash(npx awal@latest x402 details *)", "Bash(npx awal@latest x402 pay *)", "Bash(npm *)", "Bash(node *)", "Bash(curl *)", "Bash(mkdir *)"]

Technical Analysis

The allowlist grants wildcard access to npm, node, curl, and mkdir. These permissions are broader than the fixed operations necessary to create and test the documented server.

In particular, unrestricted node * permits execution of arbitrary JavaScript or local script files; npm * permits package installation and execution-related operations; and curl * permits requests to arbitrary network destinations. The trailing wildcards on wallet-related commands also permit additional uncontrolled arguments. This configuration weakens least-privilege boundaries and increases the consequences of malicious or incorrectly interpreted task content.

Attack Path

1. Malicious, injected, or otherwise untrusted task content influences the arguments selected by the agent.
2. The agent constructs a command using an allowed executable such as node, npm, or curl.
3. The broad wildcard pattern accepts the command even when its arguments are unrelated to the documented setup workflow.
4. node executes arbitrary JavaScript, npm retrieves or runs packages, or curl sends data to an attacker-controlled destination.
5. The command acts with the filesystem, process, network, and credential access available to the agent's operating-system account.

Impact Assessment

Exploitation can enable arbitrary code execution through Node.js or npm and unrestricted outbound network access through curl. An attacker could read or modify accessible files, retrieve additional payloads, transmit accessible data, interfere with the ...[truncated 239 chars]

Remediation

View remediation

Remediation Suggestions

• Replace wildcard tool permissions with exact command and argument patterns required by the workflow.
• Restrict npm to approved installation commands using pinned package versions.
• Restrict node to a known project entry point rather than allowing arbitrary arguments or inline code.
• Restrict curl to localhost for the documented health and payment checks, or to an explicit destination allowlist.
• Constrain wallet commands to their exact supported syntax and reject additional uncontrolled arguments.
• Require explicit user confirmation before package installation, mainnet payment operations, or requests to non-local destinations.
• Run the skill in a sandbox with minimal filesystem access, a restricted environment, and outbound network controls.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This is the same true positive at the manifest level: an unpinned MCP/tool package used in a financial skill. The context increases danger because malicious updates could affect wallet auth, address generation, and payment requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description is broad enough to invoke this skill for generic phrases like 'make money' or 'offer a service,' which can cause unintended activation in contexts where payment tooling, wallet access, or deployment actions are not appropriate. Mis-invocation is particularly risky here because the skill can lead an agent toward financial operations and external package execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This finding is substantively the same issue: runtime trust in @latest for a package that can interact with payment flows. The context makes it more dangerous because the skill instructs use of wallet and x402 payment commands, so compromise could redirect funds or exfiltrate credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill discusses Base mainnet and real USDC but does not prominently warn that example configurations can involve real funds. In a payments-oriented skill, that omission can lead users or agents to test on mainnet unintentionally, causing accidental financial loss or irreversible transactions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The instructional command npx awal@latest status also relies on an unpinned package fetched at runtime. Even a seemingly read-only status operation can execute arbitrary install scripts or malicious package code before printing output.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The command to retrieve the payment address uses npx awal@latest address, creating the same supply-chain exposure. In this location the risk is heightened because compromised code could return an attacker-controlled address or tamper with wallet interactions, directly impacting funds.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The test command npx awal@latest x402 details ... is another unpinned package execution path. Although framed as testing, it still resolves and executes external code dynamically, which could manipulate requests or collect service metadata unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The paid request example npx awal@latest x402 pay ... is especially sensitive because it involves payment execution. A malicious upstream package update could initiate unauthorized payments, alter destinations, or exfiltrate wallet material in a monetary context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.