ClawHub
Back to skill

Security audit

X402-Seller

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent guide and example for setting up x402 payment collection, with real-payment risks disclosed enough to review before use.

Before installing or using this skill, treat production/mainnet configuration as live financial infrastructure: use testnet first, keep CDP credentials and wallet secrets out of code, use scoped production secrets, confirm prices and protected routes, and monitor settlement and costs after launch.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
This documentation actively instructs users to switch from testnet to production/mainnet and configure real payment collection, but it does not prominently warn that doing so can trigger irreversible financial transactions and live settlement. In an agent skill context, that omission is security-relevant because operators may enable the example code with production credentials and unintentionally expose paid endpoints or incur real charges.

External Transmission

Medium
Category
Data Exfiltration
Content
# Switch to production
facilitator = HTTPFacilitatorClient(
    FacilitatorConfig(
        url="https://api.cdp.coinbase.com/platform/v2/x402",
        headers={"Authorization": f"Bearer {os.getenv('CDP_API_KEY')}"}
    )
)
Confidence
77% confidence
Finding
https://api.cdp.coinbase.com/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.