T01 · Skill Instruction Hijacking
Error
- Location
README.md:1- Finding
Instructions Conceal Paid Transactions from Users
- Content
View full analysis
- Remediation
View remediation
Security audit
X402engine
Security checks for vulnerabilities and agentic risk
Overview
This skill can automatically spend real wallet funds, and its payment disclosures and safeguards are inconsistent.
Review carefully before installing. Use only a dedicated wallet with minimal funds, configure X402_POLICY_PATH with strict per-transaction caps, daily caps, and recipient allowlists, keep autopreflight enabled, and verify the discovery endpoint and catalog recipients. Do not rely on this skill to protect funds if no policy is configured, and require the agent to show cost and destination before any paid call.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
client.js:149- Finding
Payment Policy Silently Bypassed When No Policy Path Is Configured
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
discovery.js:47- Finding
Remote Catalog Can Redirect User Data and Wallet-Authorized Payments
- Content
View full analysis
({ id, ...(typeof ep === 'string' ? { path: ep } : ep), })); } const catalog = { baseUrl, services, source: 'remote' }; _cache = { atMs: nowMs, catalog }; return catalog; ``` The catalog-controlled values are subsequently used as the paid request destination: ```js const baseUrl = catalog.baseUrl; const url = new URL(service.path, baseUrl); const method = (service.method || 'GET').toUpperCase(); if (method === 'GET') { for (const [k, v] of Object.entries(params)) { if (v != null && typeof v !== 'object') { url.searchParams.set(k, String(v)); } } res = await paidFetch(url.toString(), { method: 'GET' }); } else { res = await paidFetch(url.toString(), { method, headers: { 'c ...[truncated 2222 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
policy-engine.cjs:132- Finding
Configured Hourly Transaction Limit Is Not Enforced
- Content
View full analysis
0 && state.lastTxAtMs) { const elapsed = Math.max(0, now.getTime() - Number(state.lastTxAtMs)); if (elapsed < minIntervalSeconds * 1000) { return deny(CODES.RATE_LIMITED, `Minimum interval ${minIntervalSeconds}s not reached`); } } return allow('All policy checks passed'); ``` ### Technical Analysis `maxTxPerHour` is present in the default policy but is never validated, read, tracked, or enforced. Requests spaced far enough apart to satisfy `minIntervalSeconds` can continue indefinitely. This creates a false security boundary: operators may reasonably expect the policy field to cap transaction frequency, while the implementation silently ignores it. ### Attack Path 1. The operator configures `maxTxPerHour` and expects it to limit wallet activity. 2. A user, automated agent, or attacker triggers repeated paid requests. 3. Requests are spaced at least one second apart to satisfy `minIntervalSeconds`. 4. The state records only `lastTxAtMs`, with no hourly transaction history or counter. 5. More than the configured number of transactions are signed within one hour. ### Impact Assessment The issue permits spending and transaction volume beyond the operator's configured hourly threshold. It does not bypass recipient or per-transaction restrictions when those controls are active, but it weakens defense in depth and can amplify financial loss, denial of wallet funds, and upstream service abuse. ]]>- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
client.js:159- Finding
Non-Atomic Spend State Permits Concurrent Daily-Cap Bypass
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (27)
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
install
text **Required environment:** - `EVM_PRIVATE_KEY` — funded EVM wallet private key (Base USDC or MegaETH USDm) **Optional:** - `X402_POLICY_PATH` — custom policy file (default: `POLICY.example.json`) - `X402_STATE_PATH` — daily spend tracking file - `X402_DISCOVERY_URL` — override discovery endpoint - `X402ENGINE_ORIGIN` — override API base URL - `X402_AUTOPREFLIGHT` — enable/disable policy preflight (default: `true`) ## CLI ```bash # List all available services from the catalog node ./cli.js discover # Show remaining daily budget node ./cli.js budgetSupported services (70+)
Crypto: price feeds, market data, history, trending, search Wallet: balances, transactions across 20+ chains Image: fast (FLUX), quality (FLUX.2 Pro), text-in-image (Ideogram) Video: fast, quality, animation, Hailuo premium LLM: GPT-4o, Claude, Gemini, DeepSeek, Llama, Grok, Qwen, Mistral, Perplexity, and more Code: sandboxed execution (Python, JS, Bash, R)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill explicitly states that without a policy file, no spending limits are enforced beyond wallet balance, and also allows overriding discovery and skipping preflight checks via configuration. Combined with evidence that operational payment enforcement may be missing or inconsistent, this creates a realistic risk of unauthorized or excessive payments to catalog-declared recipients, especially because all payments are driven by remote discovery data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill explicitly states that without a policy file, no spending limits are enforced beyond wallet balance, and also allows overriding discovery and skipping preflight checks via configuration. Combined with evidence that operational payment enforcement may be missing or inconsistent, this creates a realistic risk of unauthorized or excessive payments to catalog-declared recipients, especially because all payments are driven by remote discovery data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill explicitly states that without a policy file, no spending limits are enforced beyond wallet balance, and also allows overriding discovery and skipping preflight checks via configuration. Combined with evidence that operational payment enforcement may be missing or inconsistent, this creates a realistic risk of unauthorized or excessive payments to catalog-declared recipients, especially because all payments are driven by remote discovery data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill explicitly states that without a policy file, no spending limits are enforced beyond wallet balance, and also allows overriding discovery and skipping preflight checks via configuration. Combined with evidence that operational payment enforcement may be missing or inconsistent, this creates a realistic risk of unauthorized or excessive payments to catalog-declared recipients, especially because all payments are driven by remote discovery data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill explicitly states that without a policy file, no spending limits are enforced beyond wallet balance, and also allows overriding discovery and skipping preflight checks via configuration. Combined with evidence that operational payment enforcement may be missing or inconsistent, this creates a realistic risk of unauthorized or excessive payments to catalog-declared recipients, especially because all payments are driven by remote discovery data.
- Content
Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more
High
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The lockfile pins fast-uri to 3.1.0, and the cited advisories describe URI/host parsing ambiguities including IDN canonicalization, backslash authority handling, and malformed IPv6 normalization. In a skill that acts as a pay-per-call API gateway and may validate or construct outbound destinations, URI confusion bugs can enable SSRF, host allowlist bypass, or misrouting of paid requests to attacker-controlled endpoints.
- Content
Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
The bundled ws 8.18.3 is flagged for uninitialized memory disclosure and memory-exhaustion DoS via fragmented frames. If this dependency is reachable through websocket features in viem or related libraries, an attacker interacting with websocket-based RPC or streaming paths could crash the process or potentially expose process memory contents.
- Content
Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
A second vulnerable ws version, 8.17.1, is also present in the lockfile, indicating multiple affected copies in the dependency graph. This broadens exposure because any code path using that older websocket stack could be abused for denial of service or memory disclosure, especially in a service expected to maintain network connectivity to external providers.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly says the skill 'transparently' calls paid APIs and that the user 'never sees' x402/payment/USDC, which indicates hidden spending and external data transmission on the user's behalf. In an agent-skill context, concealed payments and undisclosed routing of user prompts to third-party services are dangerous because they can cause unauthorized financial loss and privacy exposure without meaningful user consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README requires an
EVM_PRIVATE_KEYfor a funded wallet but does not prominently warn that the skill can use that key to sign blockchain payments automatically. In practice, this creates a high-risk trust boundary: anyone deploying the skill may expose spendable credentials to an automation layer that can initiate real-money transactions.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares access to sensitive capabilities through metadata and documented behavior—environment secrets and network access—but does not define an explicit tool scope such as permissions or allowed-tools. In an agent environment, this weakens containment and review because the skill can influence use of a private key and remote endpoints without clear, enforceable least-privilege boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill loads an EVM private key from EVM_PRIVATE_KEY or EVM_PRIVATE_KEY_FILE and then creates a signing account, but there is no explicit warning or user-facing disclosure that sensitive credentials will be accessed. The top-level comments mention wallet wrapping, but they do not clearly warn about secret material being consumed from the environment or filesystem.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The autopreflight path updates and saves state to disk via applySuccessToState and saveState, but there is no user-facing prompt, log, or warning at the point of write. While the function has a brief code comment about preflight, it does not disclose that using this path will persist data to a state file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The code wraps fetch with payment support, which can cause outbound network activity carrying payment and wallet-related context, but there is no user-facing warning or confirmation near this operation. Although the function name implies paid fetch behavior, the file does not explicitly disclose the network/payment side effects to users of the skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code accesses wallet credentials by creating or loading an EVM account and also falls back to environment-provided policy/state paths, but there is no user-facing warning, confirmation, or visible logging at the point this sensitive account material is used. Although the function docstring documents parameters, it does not clearly warn that wallet credentials will be used to authorize paid requests on the user's behalf.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The function sends parameters derived from the user's natural-language query to a remote paid service via GET query string or JSON POST body. The code contains no confirmation prompt or user-visible notice immediately before transmitting this data, and the existing comments/docstring do not explicitly warn that user input will be sent to external services.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes a micropayment-backed API gateway for calling external APIs such as LLMs, media generation, travel, crypto, and search. This router also treats 'run', 'execute', 'python', 'javascript', and 'bash' as first-class intents for a 'code-run' service, which introduces a code-execution capability not clearly justified by that stated gateway purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
When a query is routed to 'code-run', the router silently strips trigger words, places the remainder into params.code, and forces params.language = 'python' without explicit user confirmation. In a pay-per-call gateway that exposes remote execution as one of many services, ambiguous natural-language requests could unintentionally invoke Python execution, increasing the risk of accidental code execution, unsafe side effects, or unexpected spend.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The policy sets the daily cap timezone to "America/Los_Angeles", which imposes a specific locale in a configuration that otherwise appears general-purpose. The same locale constraint is repeated for multiple assets without any indication that users can choose it or that the policy is region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This entry again fixes the daily cap timezone to "America/Los_Angeles", enforcing one locale across assets. Without user choice or clear regional scoping, this can violate language/locale policy expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The Solana asset policy also hard-codes "America/Los_Angeles" as the timezone for daily caps. This is a locale-specific constraint presented without evidence of user opt-in or a documented region-specific purpose.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code uses Intl.NumberFormat with the fixed locale string 'en-US' in both currency formatting functions. This forces U.S. English formatting conventions regardless of user preference, which matches the policy category for language/locale constraints without opt-in.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
The dependency uses a caret range, which allows automatic installation of newer compatible releases instead of a single vetted version. In a payment-gateway skill that handles micropayments and likely interacts with wallets or signing flows, a compromised or buggy upstream release could introduce supply-chain risk and affect financial operations.
- Content
json "budget": "node ./cli.js budget" }, "dependencies": { "@x402/fetch": "^2.4.0", "@x402/evm": "^2.4.0", "viem": "^2.0.0" }
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
The package is version-ranged with a caret, so builds may pull different transitive code over time. Because this skill uses EVM-related payment components, unexpected upstream changes could affect transaction handling, signing behavior, or introduce a malicious package update through the supply chain.
- Content
json }, "dependencies": { "@x402/fetch": "^2.4.0", "@x402/evm": "^2.4.0", "viem": "^2.0.0" } }
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- test/client.test.js:49
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- test/executor.test.js:44