ClawHub
Back to skill

Security audit

x402-CLI

Security checks across malware telemetry and agentic risk

Overview

This skill is openly a crypto-payment CLI, but it can spend real wallet funds through arbitrary URLs without an approval step.

Install only if you are comfortable giving the agent access to a dedicated, low-balance EVM wallet. Do not use a personal or high-value wallet key, review every request URL, header, and payload before invocation, and consider adding external controls such as spend caps, allowlists, or a manual approval gate before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill exposes sensitive capabilities including environment-variable access, outbound network requests, and local file writes, yet it does not declare permissions in a machine-readable way. That mismatch can cause agents or policy engines to invoke it without understanding that it can access wallet secrets, write plaintext key material, or send arbitrary paid requests, increasing the risk of unintended secret exposure or financial loss.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- **Environment variable read:** it reads `CLIENT_EVM_WALLET_SECRET` (via `.env` or your shell environment) to sign payments. It does not read any other environment variables.
- **Local file writes:** `wallet create` writes a plaintext private key JSON file to disk; `discover list --save` / `discover search --save` can write JSON response files to a directory you choose.
- **No shell/subprocess execution:** this CLI does not spawn shell commands or subprocesses of its own.
- **Financial risk:** the `request` command can move real funds (Base USDC) the moment it runs, with no confirmation step. Treat every `request` invocation as a deliberate, reviewed spend authorization.

## Usage
Confidence
97% confidence
Finding
no confirmation

Credential Access

High
Category
Privilege Escalation
Content
evm_wallet_secret = os.getenv("CLIENT_EVM_WALLET_SECRET")
    if evm_wallet_secret is None:
        raise CliError(
            "CLIENT_EVM_WALLET_SECRET is not set; set it via a .env file or the shell environment.",
            ErrorCode.MISSING_ENV_VAR,
        )
    evm_wallet = Account.from_key(evm_wallet_secret)
Confidence
88% confidence
Finding
.env

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.