ClawHub
Back to skill

Security audit

clawxpay

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly designed for paid API calls, but it relies on an unpinned npm package that auto-creates a funded crypto wallet and stores the private key as plaintext.

Install only if you are comfortable using a dedicated low-balance crypto wallet for API payments. Verify the npm package provenance and version before installing, keep only small amounts of USDC in the generated wallet, exclude the key file from backups and logs, and do not let agents read or display ~/.clawxpay/wallet.key.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
skill.md:23
Finding

Unpinned Third-Party Package Executes During Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skill.md:15
Finding

Cryptocurrency Private Key Stored as Plaintext File

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
87% confidence
Finding

The manifest advertises creation and storage of a wallet private key in a predictable local path and describes exporting it with a shell command. Even though the skill says not to expose the key, normalizing direct filesystem secret storage in plaintext hex materially increases the chance that an agent, plugin, log collector, backup process, or compromised local environment will access or exfiltrate it. In a payment-enabled skill, compromise of this key can directly lead to wallet takeover and loss of funds.

Content

Scanner excerpt · skill.md (reported line 3)May include surrounding context.

md
---
name: clawxpay
description: >
  Pay-per-call API gateway — zero account, zero API key, zero subscription via the x402 protocol.
  One Base wallet + USDC is all you need to access 250+ professional API endpoints on a per-call basis:
  real-time crypto prices and on-chain data (coinank · nofxos · coinmarketcap),
  US stock options and technical indicators (alphavantage · polygon · alpaca · twelvedata),
  China A-share market (tushare), Web3 project funding intelligence (rootdata),
  and 7 AI model providers (OpenAI · Anthropic · DeepSeek · Qwen · Gemini · Grok · Kimi).
  From $0.001 per call — s

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · skill.md (reported line 332)May include surrounding context.

md
console.error(`Balance insufficient — current: ${bal} USDC. Please top up.`);
  } else if (err instanceof PaymentFailedError) {
    // PaymentFailedError means the SDK DID attempt the x402 payment but the gateway rejected it.
    // This is NOT "you forgot to pay" — do NOT ask the user to deposit more.
    // Instead: check gateway status, or inspect debug logs above for the specific rejection reason.
    console.error('Payment was attempted but gateway rejected it:', err.message);
    console.error('Do NOT retry automatically — check gateway status first.');

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · skill.md (reported line 351)May include surrounding context.

md
| `Cannot find module 'clawxpay-js'` | Package not installed | `npm install clawxpay-js` |
| `require is not defined in ES module scope` | clawxpay-js is ESM-only; `require()` does not work | Save file as `.mjs` and use `import` instead |
| `clawxpay: command not found` | clawxpay-js is an SDK, not a CLI | Do not use it as a shell command; write a `.mjs` script and run `node script.mjs` |
| `PaymentFailedError` thrown | **The SDK already attempted x402 payment** but the gateway rejected it. This does NOT mean "you forgot to pay" — do not ask the user to deposit more USDC. | Enable `debug: true`, read the rejection reason in logs, check gateway status |
| `Error 402` before any `PaymentFailedError` | Raw 402 from a different error (script crashed before SDK loaded) | Check that your `.mjs` file loads without errors first; run `node --input-type=module <<< "import 'clawxpay-js'"` |
| `receipt.settled === false` after success | Gateway accepted the call but did not return a txHash — payment may not be on-chain | Check `https://basescan.org/address/<wallet>` to see if USDC left the wallet; report to gateway operator |
| `Balance shows 0` after depositing | Deposit still pending, or sent to wrong network | Wait ~30 s and retry; confirm deposit was on **Base mainnet**, not Ethereum mainnet |