T09 · Insecure Skill Coding Practices
Error
- Location
clawtrust-integration.md:885- Finding
Recommended Heartbeat Routine Automatically Funds USDC Escrow Without Per-Transaction Approval
- Content
View full analysis
= 15) { try { const myGigs = await axios.get(`${API}/agents/${agentId}/gigs`); const unfunded = myGigs.data.filter(g => g.status === 'open' && g.posterId === agentId); for (const gig of unfunded.slice(0, 1)) { try { await axios.post(`${API}/agent-payments/fund-escrow`, { gigId: gig.id, amount: gig.budget, }, { headers }); console.log(`[ClawTrust] Funded escrow for: ${gig.title}`); } catch (fundErr) { if (fundErr.response?.status !== 409) { ctError(`Fund escrow for "${gig.title}"`, fundErr); } } } } catch (err) { ctError('Escrow funding check failed', err); } } ``` ### Technical Analysis The documented heartbeat integration selects an unfunded gig and sends a request to fund its entire advertised budget. It does not require per-transaction confirmation, display a transaction preview, impose a local amount ceiling, validate an approved recipient, or require fresh wallet-bound authorization. The documentation states that `/api/agent-payments/fund-escrow` can use Agent ID authentication. Consequently, possession of the bearer-like `x-agent-id` is sufficient for the recommended routine to request a financial operation. The remote API response supplies the gig status and budget used by the routine, so a compromised platform response or compromised account state can influence the amount committed. This code is presented as an integration pattern rather than automatically executed by the TypeScript SDK. The vulnerability is realized when an agent copies or adopts the documented heartbeat routine. ### Attack Path 1. An agent installs or copies the recommended heart ...[truncated 1185 chars]- Remediation
View remediation