Epstein Emails (x402)

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:56 PM UTC
• Version: 1.0.1

Overview

The skill is a disclosed paid API helper for querying Epstein email records, with clear cost and wallet warnings, but it should be used only with an isolated low-balance wallet.

Install only after reviewing the payment model. Use a fresh hot wallet with only the USDC needed for approved requests, never reuse a valuable wallet key, pin and isolate dependencies where possible, and confirm cost before any paid or paginated query.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:173

Finding

Unpinned Third-Party Dependencies in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 173
Vulnerability Type: Unpinned third-party Python dependencies
Risk Level: Medium

Complete Code Snippet:

python

# pip install "x402[httpx,evm]" eth_account

import asyncio
import os
from eth_account import Account
from x402 import x402Client
from x402.http.clients import x402HttpxClient
from x402.mechanisms.evm import EthAccountSigner
from x402.mechanisms.evm.exact.register import register_exact_evm_client

The unpinned installation command is also repeated at line 268:

markdown

- x402 Python SDK: `pip install "x402[httpx,evm]"`

Technical Analysis

The installation instructions retrieve x402, its optional dependencies, and eth_account without exact version constraints or cryptographic integrity hashes. Consequently, the code installed when these instructions are followed can change independently of the reviewed skill.

These packages execute in the same Python process that later reads XCLAW02_PRIVATE_KEY and constructs an EVM signer. A compromised package release, compromised transitive dependency, dependency-confusion event, or malicious update could therefore access the process environment, intercept signer operations, alter payment destinations, or execute arbitrary code with the invoking user's privileges.

The audit did not establish that the named packages are currently malicious. The finding concerns the unsafe, non-reproducible dependency installation practice and the heightened impact created by using those dependencies in a wallet-signing workflow.

Attack Path

1. An attacker compromises a named package, one of its transitive dependencies, or the package-distribution path.
2. A user follows the documented unpinned pip install command and receives the attacker-controlled version.
3. The user runs the example with XCLAW02_PRIVATE_KEY available in the process environment.
4. Malicious package ...[truncated 1073 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an exact, reviewed version, including x402 and eth-account.
2. Generate and commit a lockfile that resolves exact transitive dependency versions.
3. Require cryptographic hashes for installed distributions, such as through a hash-locked requirements file and pip install --require-hashes.
4. Install only from an explicitly configured, trusted package index and disable unintended extra indexes to reduce dependency-confusion exposure.
5. Review package provenance, release signatures where available, maintainers, and dependency changes before updating locked versions.
6. Install and run the client in an isolated virtual environment or container with minimal filesystem and network access.
7. Continue using a dedicated wallet containing only the funds required for approved requests. Avoid placing valuable wallets or unrelated secrets in the same process environment.
8. Where the SDK supports it, enforce payment amount, network, token, recipient, and cumulative spending limits in code rather than relying only on documentation.
9. Replace both installation examples with the same reproducible, version-locked procedure so users are not directed back to an unpinned command.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.

md

| Network | Base (eip155:8453) |
| Token | USDC (0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913) |
| Gas | None (facilitator-sponsored) |
| Facilitator | Coinbase CDP (https://api.cdp.coinbase.com/platform/v2/x402) |
| Recipient | 0xF9702D558eAEC22a655df33b1E3Ac996fAC2f1Ea |

The payment flow is automatic when using an x402-compatible client:

Static analysis

No suspicious patterns detected.