x402-market-recon

• Outcome: Pass
• Latest audit: Oct 14, 2026 · 2:43 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed, read-only x402 market measurement tool with limited local report writing and no payment, credential, persistence, or shell behavior.

Install this only if you want an agent to perform live HTTPS reads against x402 registries and seller endpoints and write measurement reports locally. Treat --allow-any-host as an explicit decision to contact third-party public endpoints, and review the generated reports before making payment-path or listing changes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file defines activation triggers, so SQP-1 applies. While several quoted examples are specific, the phrase "or any plan that touches a payment path, a discovery document or a listing on the strength of a hunch" is broad and ambiguous, making it unclear when the skill should or should not activate.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

import urllib.request
from concurrent.futures import ThreadPoolExecutor

DISCOVERY = "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources"
UA = "Mozilla/5.0 (compatible; x402-market-recon/1.1; read-only)"

DOCUMENTED_HOSTS = frozenset({

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/recon_x402_market.py (reported line 48)May include surrounding context.

python

import urllib.request
from concurrent.futures import ThreadPoolExecutor

DISCOVERY = "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources"
UA = "Mozilla/5.0 (compatible; x402-market-recon/1.1; read-only)"

DOCUMENTED_HOSTS = frozenset({

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · scripts/recon_x402_market.py (reported line 415)May include surrounding context.

python

common = argparse.ArgumentParser(add_help=False)
    common.add_argument("--allow-any-host", dest="allow_any_sub", action="store_true",
                        default=argparse.SUPPRESS,
                        help="permit unpaid reads of hosts beyond the documented list")

    ap = argparse.ArgumentParser(description="measure the x402 market, read-only")
    ap.add_argument("--allow-any-host", dest="allow_any", action="store_true",

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · scripts/recon_x402_market.py (reported line 419)May include surrounding context.

python

common = argparse.ArgumentParser(add_help=False)
    common.add_argument("--allow-any-host", dest="allow_any_sub", action="store_true",
                        default=argparse.SUPPRESS,
                        help="permit unpaid reads of hosts beyond the documented list")

    ap = argparse.ArgumentParser(description="measure the x402 market, read-only")
    ap.add_argument("--allow-any-host", dest="allow_any", action="store_true",

Static analysis

No suspicious patterns detected.