T09 · Insecure Skill Coding Practices
Error
- Location
scripts/x402-generate.mjs:45- Finding
Automatic x402 payment signing lacks local amount and destination limits
- Content
View full analysis
80 ? '...' : ''}"`); console.log(` Model: ${model}`); console.log(` Duration: ${duration}s`); if (agentId) console.log(` Agent: ${agentId}`); console.log(); const res = await fetchWithPayment(`${API_BASE}/generation/create`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ prompt, videoModel: model, duration, ...(agentId && { agentId }) }), }); ``` ### Technical Analysis The script gives the x402 client access to a signer derived from `EVM_PRIVATE_KEY` and then lets the wrapper automatically process a `402 Payment Required` response, create a payment authorization, and retry the request. The executable does not independently validate: - The maximum USDC amount the user approved. - The expected Base chain identifier. - The canonical Base USDC contract. - The intended payment receiver. - Whether the returned payment requirements match a previously displayed pre-flight quotation. - Whether the user explicitly approved that exact payment tuple. `SKILL.md:173-201` instructs the agent to display a pre-flight quotation ...[truncated 1647 chars]- Remediation
View remediation