ClawHub
Back to skill

Security audit

X402-Seller

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for setting up x402 payment services, but it handles cryptocurrency and API secrets through under-scoped dependency and command-line workflows that deserve manual review before install.

Review the referenced third-party skills before letting them generate wallets or receive private keys, prefer pinned or audited tools, and avoid entering private keys or API secrets as command-line arguments. Use trusted HTTPS facilitator URLs only, restrict CDP key permissions and limits, and treat any custom facilitator as a party that can see payment verification metadata.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
example/app.py:13
Finding

Unrestricted Facilitator URL Can Expose Buyer Payment Proofs

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:54
Finding

Unpinned Third-Party Skills Are Entrusted with Cryptocurrency Secrets

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 411)May include surrounding context.

md
- **[SKILL.md](./SKILL.md)** — This file; overview and quick-start guide

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · example/README.md (reported line 18)May include surrounding context.

  1. Copy the environment template:
bash
cp .env.example .env
  1. Fill in your receiving address:

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High
Category
Supply Chain
Confidence
70% confidence
Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The setup instructions tell users to pass wallet private keys and API secrets directly as command-line arguments to keepass-cli. Secrets supplied on the command line can be captured in shell history, terminal logging, audit systems, and process listings, which can expose private keys and API credentials to other local users or later forensic access.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 324)May include surrounding context.

md
### Payment Verification

**Do not skip verification.** Always:
1. Require valid `PAYMENT-SIGNATURE` header
2. Verify the signature with the facilitator
3. Check that payment amount matches your declared price

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · x402DOCS.md (reported line 317)May include surrounding context.

python
facilitator = HTTPFacilitatorClient(
    FacilitatorConfig(
        url="https://api.cdp.coinbase.com/platform/v2/x402",
        headers={"Authorization": f"Bearer {os.getenv('CDP_API_KEY')}"}
    )
)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · x402DOCS.md (reported line 503)May include surrounding context.

python
facilitator = HTTPFacilitatorClient(
    FacilitatorConfig(
        url="https://api.cdp.coinbase.com/platform/v2/x402",
        headers={"Authorization": f"Bearer {os.getenv('CDP_API_KEY')}"}
    )
)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · x402DOCS.md (reported line 560)May include surrounding context.

python
facilitator = HTTPFacilitatorClient(
    FacilitatorConfig(
        url="https://api.cdp.coinbase.com/platform/v2/x402",
        headers={"Authorization": f"Bearer {os.getenv('CDP_API_KEY')}"}
    )
)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · x402DOCS.md (reported line 577)May include surrounding context.

python
facilitator = HTTPFacilitatorClient(
    FacilitatorConfig(
        url="https://api.cdp.coinbase.com/platform/v2/x402",
        headers={"Authorization": f"Bearer {os.getenv('CDP_API_KEY')}"}
    )
)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · x402DOCS.md (reported line 692)May include surrounding context.

python
facilitator = HTTPFacilitatorClient(
    FacilitatorConfig(
        url="https://api.cdp.coinbase.com/platform/v2/x402",
        headers={"Authorization": f"Bearer {os.getenv('CDP_API_KEY')}"}
    )
)

Static analysis

No suspicious patterns detected.