AgentIndex x402 Tools

• Outcome: Review
• Latest audit: Sep 20, 2026 · 1:16 AM UTC
• Version: 1.0.4

Overview

This skill is coherent for paid web and data tools, but it can direct an agent to spend USDC without clearly requiring transaction-specific user approval or hard price checks.

Review this skill before installing if your agent has access to a funded wallet. Use it only with payment clients that require explicit confirmation, enforce per-call and session spending limits, verify Base USDC terms and recipients, and reject unexpected payment requirements.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:44

Finding

Payment workflow lacks mandatory authorization and payment-term validation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44–48 and 56–58
Vulnerability Type: Unvalidated wallet payment authorization
Risk Level: Medium

Relevant snippet:

markdown

## How to pay

1. Request the URL → HTTP **402** + payment requirements.
2. Sign exact USDC (x402 / EIP-3009) → retry with `Payment-Signature`.
3. **Hermes + PipRail:** `piprail_quote_payment(url)` then `piprail_pay_request(url)`.
4. **OpenClaw:** `x402_fetch` / `x402_pay` on the URL (or Bazaar search then pay).
5. **MCP:** connect to `https://x402.agentindex.world/mcp/` (tools `weather`, `crypto`, `news`, `can_pay`, `probe`, …).

markdown

- Prefer the cheapest suitable route: $0.0001 for search and wallet/gas reads,
  $0.001 for weather/crypto/news, and $0.002 for PDF or web reading.
- Do not loop on unpaid 402s from scanners — if you have a funded wallet, pay once.
- Network must be Base mainnet USDC.

Technical Analysis

The Skill directs an agent with access to a funded wallet to obtain payment requirements from an HTTP 402 response and then sign and submit a USDC payment. It does not require the execution path to:

• Obtain explicit user approval for the final transaction.
• Compare the requested amount with the documented route price.
• Verify the payment recipient against an approved address.
• Display the exact amount, recipient, network, and endpoint before signing.
• Enforce a hard per-request or aggregate spending limit.

The advertised prices are descriptive text rather than technically enforced authorization constraints. Consequently, payment terms supplied by the remote endpoint cross from an external trust domain into wallet authorization. The instruction to “pay once” does not constrain the amount or recipient and is not equivalent to transaction-specific user confirmation.

Attack Path

1. A user asks for data supported by the Skill, such as web search, PDF conversion, or wa ...[truncated 1390 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, transaction-specific user confirmation before every payment.
• Present the exact amount, recipient address, network, asset, endpoint, and requested operation in the confirmation prompt.
• Enforce hard maximum prices for every route and reject payment requirements exceeding the documented price.
• Verify the payment recipient against a pinned allowlist of approved addresses.
• Bind the signed authorization to the intended endpoint, operation, amount, asset, chain, and recipient.
• Default to sample, preview, or quote-only routes until the user approves payment.
• Configure per-request and session-wide spending limits in the payment client.
• Reject unexpected chains, assets, redirects, recipients, or payment-requirement formats.
• Record the verified quote and resulting transaction identifier for user review without logging signing secrets.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The description says to use the skill whenever an agent needs current web or document data without an account or API key, which is a very wide condition rather than a narrowly scoped trigger. It does not provide explicit trigger phrases, exclusions, or negative examples to clarify when this skill should be chosen versus other search, web-read, or document tools.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.