Security audit
Intel — AI Web Search (x402)
Security checks across malware telemetry and agentic risk
Overview
The skill's stated purpose (on‑chain paid web search) mostly matches its requirements, but several instruction and install choices—most notably asking for a raw private key, encouraging embedding it in URLs, and dynamically running an npm package via npx—are disproportionate or risky and warrant caution.
This skill is coherent with an on‑chain paid search service, but it asks you to provide a raw private key and to run external npm code at runtime — both are high‑risk choices. Before installing: (1) Do NOT use your primary wallet private key. Create a dedicated signing wallet with only a small USDC balance and use that key instead. (2) Avoid embedding keys in URLs or shared config files; query‑param keys can appear in logs and referrers. Prefer an external signer or local keyring if possible. (3) Review the npm package (intel-asrai-mcp) and the GitHub repo yourself before allowing npx to run it; consider pinning a specific vetted version rather than using npx -y. (4) Be aware each search costs $0.005 USDC and autonomous invocation could cause charges; monitor the wallet and keep minimal funds. (5) If you have strict security needs, run this skill in an isolated environment (sandbox VM or container) and limit network access until you review the code and endpoint behavior.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings