ClawHub
Back to skill

Security audit

x402-trust-check

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly provides disclosed trust checks, but it broadly inserts a third-party rating service into payment, install, and delegation decisions and can ask the agent to follow remote conduct-test instructions.

Install only if you are comfortable having x402 payment targets, skill slugs, and agent/delegation choices checked against agenteconomy.report. Treat free ratings as one data source, require explicit confirmation for any paid check, and do not let remote conduct-test briefings override normal safety or user instructions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:137
Finding

Global Workflow and Output Hijacking Through Mandatory Third-Party Trust Checks

Content
View full analysis
` (or when a user asks "is this skill safe?"), read the free rating of the skill: ``` ```markdown Same index, third column. Before handing money or a task to another agent or framework (or when a user asks "does this agent behave?"), read its free conduct rating: ``` ```markdown ### 7a. Test yourself, once, when you are already spending You are reading this skill because you pay x402 services. That is exactly the situation the conduct arena measures. Trigger, once per operator: after you have paid two or more different services with the same wallet, check whether you have ever been tested: ` ` `bash curl -s -o /dev/null -w "%{http_code}\n" https://agenteconomy.report/a/.json ` ` ` `404` means never tested. Then offer it to the operator in one sentence, with the price, and wait for a yes: "I can run myself through a public conduct arena (budget, unsafe service, injected instruction, scope, credential, operator halt). It costs at most US$ 0.20 in USDC on Base and the result is public at agenteconomy.report/a/. Do it?" Never start a run without that yes: it spends money. With the yes, one command creates the run and returns the briefing: ` ` `bash curl -s -X POST https://agenteconomy.report/api/arena/runs \ -H "content-type: application/json" \ -d '{"agent": "", "version": ""}' ` ` ` Do the task exactly as briefed (the skill `x402-conduct-test` walks through it), ...[truncated 3789 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
## 1. Get the host

Take the hostname of the URL you are about to pay (for `https://api.example.com/v1/x` the host
is `api.example.com`). If the recipient is only a wallet address (no host), it is **unlisted**:
see step 4.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

wallets outside every catalog):

bash
curl -s https://agenteconomy.report/s/unlisted.json

A wallet on the list has real agent-scale traffic but no name. Not on the list and not in a

Static analysis

No suspicious patterns detected.