OpenDexter

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:30 AM UTC
• Version: 1.0.0

Overview

This skill is coherent for an x402 paid API marketplace, but it can spend USDC from a configured wallet without requiring a clear final confirmation for each payment.

Install only if you are comfortable with an agent using a configured wallet for x402 payments. Before any paid call, require the agent to show the endpoint, exact price, chain, and whether the action repeats, then get your explicit approval.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:25

Finding

Automatic USDC Payment Without Explicit Final User Confirmation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-29 and 40-49
Vulnerability Type: Missing transaction-specific authorization before wallet spending
Risk Level: Medium

Vulnerable Code Snippet

markdown

### `x402_fetch` — Call and Pay

Call any x402 endpoint with automatic payment from the configured wallet. The plugin checks USDC balances across all funded chains and picks the best option. Returns the API response data plus a payment receipt.

If the wallet has no funds on any accepted chain, tell the user to fund their wallet.

markdown

### "Find me an API for X"
1. `x402_search` with their query
2. Present top results with prices and quality scores
3. `x402_check` on their pick
4. Show per-chain pricing
5. `x402_fetch` to call it

### "Call this URL"
1. `x402_check` to show the price
2. `x402_fetch` to call and pay

Technical Analysis

The skill instructs the agent to invoke x402_fetch, which automatically spends USDC from a configured Solana or EVM wallet. Although x402_check previews pricing, the documented workflows proceed directly from displaying the price to executing payment. They do not require explicit, transaction-specific user confirmation after the endpoint, exact cost, payment network, and other transaction details are known.

This weakens least-privilege and user-authorization boundaries around a financially sensitive tool. A request to inspect an endpoint, select a search result, or preview a price could be interpreted as authorization to spend funds. Automatic selection among funded chains further means the user may not have approved the precise transaction ultimately performed.

Attack Path

1. A user asks the agent to find an API or supplies an x402 endpoint.
2. The agent runs x402_search or x402_check and displays the available price.
3. The workflow instructs the agent to proceed immediately to x402_fetch.
4. The plugin identi ...[truncated 739 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit confirmation immediately before every invocation of x402_fetch or x402_pay.
2. Before requesting confirmation, display:
   • The exact endpoint and HTTP operation.
   • The maximum USDC amount.
   • The selected blockchain network.
   • The payment recipient, when available.
   • Whether the operation is one-time or repeated.
3. Treat endpoint selection, price inspection, and earlier general requests as insufficient payment authorization.
4. Do not automatically select a chain until the user has either approved that specific chain or explicitly enabled automatic chain selection.
5. Enforce a conservative per-call spending limit independently of agent instructions.
6. Require renewed confirmation whenever the endpoint, price, recipient, network, or number of calls changes.
7. Add a safe workflow step such as:

   markdown

   5. Present the exact transaction details and ask for explicit confirmation.
   6. Invoke `x402_fetch` only after the user confirms those details.
   

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description is very broad and can cause the skill to activate for generic requests about APIs, pricing, wallets, or marketplaces without clearly signaling that real-money payment may occur. In this skill’s context, unintended invocation is more dangerous than usual because activation can lead directly to paid external calls from a configured wallet.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill describes automatic payment from the configured wallet but does not prominently warn users that invoking the fetch tool can spend funds. Because the workflow encourages calling x402_check and then x402_fetch, a user may not realize that the second step authorizes a live paid transaction, creating risk of accidental charges or abuse if the skill is invoked unexpectedly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.