clawdio

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:21 AM UTC
• Version: 1.1.0

Overview

The skill is a coherent paid API guide, but it encourages automatic wallet-backed purchases without clear user confirmation or spending controls.

Install only if you are comfortable connecting an x402-compatible wallet and paying 1.49 USDC per report on Base Mainnet. Use a dedicated low-balance wallet, require explicit approval before each purchase, validate the endpoint and payment terms, and protect CDP or wallet secrets outside source control and logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:57

Finding

Automatic x402 Wallet Payments Lack Locally Enforced Transaction Constraints

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:57-64; references/INTEGRATION.md:27-29,82-92
Vulnerability Type: Unrestricted automatic wallet payment authorization
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:57-64:

markdown

Uses **x402 protocol**. Your wallet handles payment automatically:

1. Server responds HTTP 402 with payment requirements
2. Wallet signs USDC payment on Base Mainnet
3. Request retries with payment signature
4. Full artifact set returned after settlement

No accounts. No API keys. Payment is the only gate.

references/INTEGRATION.md:27-29:

javascript

// Agent can now browse and purchase Clawdio reports automatically.
// Point it at https://clawdio.vail.report/ and it will self-discover the API.

references/INTEGRATION.md:82-92:

text

  |  [wallet signs USDC payment]  |                              |
  |                               |                              |
  |  GET /catalog/purchase?id=... |                              |
  |  (PAYMENT-SIGNATURE header)   |                              |
  |------------------------------>|                              |
  |                               |  verify + settle payment     |
  |                               |----------------------------->|
  |                               |  settlement confirmation     |
  |                               |<-----------------------------|
  |  200 OK                       |                              |
  |  (full artifacts + tx hash)   |                              |

Technical Analysis

The documented integration delegates x402 payment handling to an agent wallet and states that report purchases may occur automatically. However, the examples do not demonstrate local validation of the payment requirements returned by the remote server.

In particular, the integration does not explicitly enforce:

• The expected Base ...[truncated 2442 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse and validate every x402 payment requirement before requesting a signature.
2. Enforce the exact expected chain ID, canonical USDC contract, approved recipient, and a maximum amount of 1.49 USDC per report.
3. Bind authorization to the selected catalog product and reject mismatched, expired, replayed, or reused payment requirements.
4. Require explicit user confirmation that displays the recipient, asset, network, and total amount before settlement.
5. Configure a dedicated low-balance wallet with strict per-transaction and daily spending limits rather than using a general-purpose wallet.
6. Reject redirects or cross-origin payment destinations unless they are explicitly allowlisted.
7. Pin the expected API origin and rely on strict TLS certificate validation.
8. Log payment requests and settlement results without recording wallet secrets or reusable authorization material.
9. Update the integration examples to show validation and rejection logic instead of presenting automatic signing as unconditional.
10. Clarify which protections are enforced by AgentKit or @x402/fetch and which controls must be implemented by the integrating application.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill processes Twitter Spaces and voice conversations and returns transcripts, participant handles, avatars, and other metadata via an external service, but the documentation does not warn about privacy implications of transmitting or handling potentially sensitive voice-derived data. In this context, that omission is material because agents may send links or conversation-derived data to a third party without informing users about disclosure, retention, or consent concerns.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly states that the wallet handles payment automatically and that the request retries with a payment signature, but it does not prominently warn the user that invoking the purchase flow will spend USDC. In an agent context, this creates a real risk of unintended on-chain spending because a model or automation layer may follow the documented flow without surfacing a clear spending confirmation to the end user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation explicitly instructs clients to make a GET request that can trigger an automatic x402 wallet payment flow, but it does not prominently warn that this action may immediately initiate a paid blockchain transaction. In an agent context, especially one designed for automated consumption, this increases the risk of unintended purchases, silent wallet spending, or SSRF-style fetches that have financial side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide explicitly says the payment flow is fully automatic and that an agent can browse and purchase reports automatically, but it does not warn that this can trigger real on-chain or wallet-backed spending. In an agent setting, that omission can lead to unintended autonomous purchases, especially because the documentation encourages self-discovery of the API and hands control to the framework.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The example shows sensitive credential configuration through environment variables and wallet secrets without any nearby warning about secret handling, least privilege, or avoiding hardcoding/logging. While using environment variables is common practice, omission of handling guidance in copy-paste integration docs increases the chance that users expose API keys or wallet secrets in insecure deployments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.