Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marks this skill suspicious because scanners report that its endpoint checks can follow redirects to unintended destinations and its offline signature check does not establish who issued the result.
Consider avoiding installation until the redirect handling and offline verification concerns are addressed. If you use the hosted-verdict workflow, consider that the target URL is sent to a third-party service. The scan was partial because two local references could not be resolved, so its evidence is incomplete.
scripts/weigh_x402_endpoint.pyAutomatic redirects bypass destination validation
The endpoint can cause requests to internal HTTP services reachable from the agent, including unauthenticated GET handlers with side effects. Redirects also bypass the stated eight-request budget. Internal HTTPS access remains subject to normal certificate validation; credential extraction is not established.
SKILL.mdOffline verification trusts an attacker-supplied signing key
An attacker can generate a key pair, fabricate favorable endpoint measurements, recompute the hash, and sign the payload. Both documented checks pass despite the document not originating from the arena service, defeating the advertised provenance guarantee.
The HTTPS-only, per-hop-guarded guarantee is not enforced by the supplied implementation, whose HTTP client automatically follows redirects without checking each destination. The read-only claim is also too strong: default probing sends a POST, and an unpaid request can still modify server state if the destination processes it.
The verification example obtains its verification key from the same untrusted document it authenticates. An attacker can generate a key pair, fabricate a verdict, recompute its hash, and sign it successfully, so passing this check does not establish arena-service origin and could mislead payment decisions.
The skill uses 'file_write' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
The skill uses 'network' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
urllib.request.urlopen follows redirects internally, so guard_url checks only the initial URL rather than each actual destination. An attacker-controlled public endpoint can redirect to HTTP or internal services, bypassing the advertised SSRF protections and per-request budget; the surrounding loop never validates these hidden hops.
Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.
("https://127.0.0.1/paid", "private/loopback"),
("https://localhost/paid", "loopback"),
("https://10.0.0.5/paid", "private/loopback"),
("https://169.254.169.254/latest/meta-data", "private/loopback"),
("https://::1/paid", "private/loopback"),
("https://192.168.1.1/admin", "private/loopback"),
("https://", "missing host"),
The workflow instructs the user to submit the target URL to xhagents.xyz to obtain a hosted verdict. Although the request is shown, there is no privacy warning that this shares the endpoint address with the hosted operator, potentially exposing sensitive paths or query parameters; the capability disclosures describe only requests to the named endpoint and its origin.