X402

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:35 PM UTC
• Version: 0.1.0

Overview

The skill is openly for x402 paid API calls, but it gives broad automatic-use guidance around real USDC spending and mutable third-party command execution.

Review before installing. Only use this skill for explicit x402 tasks, inspect prices and endpoints first, set --max-amount for every paid request, and avoid arbitrary or untrusted URLs. Prefer a pinned and reviewed awal version, and do not run payment commands from an environment with wallet funds you are not prepared to spend.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:11
• Finding: Unpinned Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md`, lines 11 and 26 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: High **Vulnerable Code Snippet**: ```markdown Use the `npx awal@latest x402` commands to discover, inspect, and call paid API endpoints using the X402 payment protocol. ``` ```bash npx awal@latest x402 bazaar search <query> [-k <n>] [--force-refresh] [--json] ``` ### Technical Analysis The Skill directs the Agent to execute `awal@latest` through `npx`. The `latest` tag is mutable and does not identify a fixed, previously reviewed package version. When the command runs, npm can download and execute whichever release the package registry currently associates with that tag. Consequently, the effective executable code can change after this Skill has been audited. A compromised maintainer account, malicious future release, registry compromise, or package ownership transfer could cause arbitrary code to execute with the permissions of the Agent process. This risk is particularly significant because the documented CLI is associated with an authenticated wallet and automatic USDC payments. Code executing in that environment may be able to access local Awal configuration, authentication material, wallet-related state, files readable by the current account, and network resources available to the host. ### Attack Path 1. An attacker compromises the `awal` package publishing process, maintainer account, or package registry entry, or publishes a malicious version that becomes the `latest` release. 2. The Agent follows the Skill instructions and invokes `npx awal@latest x402 ...`. 3. `npx` resolves the mutable `latest` tag and downloads the attacker-controlled package version. 4. Package installation hooks or the invoked CLI entry point execute attacker-controlled code under the Agent user's privileges. 5. The malicious code can inspect local files and environment dat ...[truncated 710 chars]
• Remediation: ## Remediation Suggestions 1. Replace `awal@latest` with an exact, reviewed package version, such as `awal@X.Y.Z`. 2. Record the dependency in a package manifest and commit a lockfile containing integrity hashes. 3. Install dependencies using a lockfile-enforcing command such as `npm ci`, rather than resolving a mutable package tag during Skill execution. 4. Verify the package's official publisher, source repository, signatures or provenance attestations, and expected integrity digest. 5. Disable or carefully review npm lifecycle scripts where operationally possible. 6. Run the CLI in a sandbox with restricted filesystem access, limited environment variables, and narrowly scoped network access. 7. Keep wallet credentials outside the package process where possible and require explicit authorization for every payment. 8. Establish a controlled upgrade process in which new versions are reviewed and tested before the pinned version is changed.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:49
• Finding: State-Changing HTTP Methods Used to Probe Arbitrary Endpoints## Vulnerability Details **File Location**: `SKILL.md`, lines 49–55 **Vulnerability Type**: Unsafe arbitrary-endpoint probing **Risk Level**: Medium **Vulnerable Code Snippet**: ```markdown ### Discover Payment Requirements Inspect an endpoint's x402 payment requirements without paying: ```bash awal x402 details <url> [--json] ``` Auto-detects the correct HTTP method (GET, POST, PUT, DELETE, PATCH) by trying each until it gets a 402 response, then displays price, accepted payment schemes, network, and input/output schemas. ``` ### Technical Analysis The documented discovery process attempts multiple HTTP methods, including `POST`, `PUT`, `DELETE`, and `PATCH`, against a supplied URL. These methods are commonly state-changing. Using them merely to detect payment requirements can create, update, or delete server-side resources before a `402 Payment Required` response is found. The Skill does not specify destination validation, trusted-host allowlisting, private-network restrictions, redirect validation, user confirmation, or a safe-method-only discovery mechanism. If an attacker can influence the URL, the Agent may send requests to services reachable from its host, including loopback, private, link-local, or otherwise internal destinations. This is not necessarily a vulnerability in the remote service itself; exploitation requires a reachable endpoint that performs an action for one of the attempted methods. Nevertheless, the Skill's prescribed behavior unnecessarily converts endpoint inspection into potentially state-changing network activity. ### Attack Path 1. An attacker persuades a user or Agent to inspect an attacker-selected URL, or supplies the URL through untrusted task content. 2. The Agent executes `awal x402 details <url>` as instructed by the Skill. 3. The CLI tries `GET`, `POST`, `PUT`, `DELETE`, and `PATCH` until it receives a qualifying `402` response. 4. One of the state-changing req ...[truncated 1083 chars]
• Remediation: ## Remediation Suggestions 1. Restrict payment-requirement discovery to non-state-changing methods such as `HEAD`, `GET`, or `OPTIONS`. 2. Require the user to specify and explicitly approve an HTTP method before sending any `POST`, `PUT`, `PATCH`, or `DELETE` request. 3. Validate URLs and allow only expected schemes, preferably `https`. 4. Reject loopback, private, link-local, multicast, and cloud metadata address ranges after DNS resolution. 5. Revalidate every redirect target and prevent redirects from public destinations to restricted network ranges. 6. Use a trusted-domain allowlist for payment endpoints where practical. 7. Do not attach credentials or sensitive headers during endpoint discovery. 8. Display the resolved destination, method, and expected action before issuing a state-changing request. 9. Prefer a standardized metadata endpoint or explicit x402 discovery mechanism that does not require probing multiple methods. 10. Document that arbitrary URLs from untrusted content must not be inspected without destination validation and user approval.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The documentation describes automatic USDC payment but does not present a prominent warning that `pay` performs real paid network requests using the user's wallet funds. In this context, that omission is dangerous because the skill is user-invocable, broadly described, and capable of sending money to arbitrary discovered endpoints, making accidental spending or abuse more likely.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The description says to use this skill when there is no clear tool to choose and to search the bazaar or call paid services broadly, which makes over-invocation likely. Because this skill can lead to authenticated paid requests and interaction with arbitrary third-party endpoints, broad routing language increases the chance of accidental use in unrelated contexts and unnecessary exposure to spend or data-leak risks.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill instructs use of `npx awal@latest`, which fetches and executes the latest package version at runtime instead of a pinned, reviewed version. In a security-sensitive skill that can initiate paid network actions, a compromised or breaking upstream release could execute unexpected code, alter payment behavior, or exfiltrate credentials and wallet-related data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Static analysis

No suspicious patterns detected.