T09 · Insecure Skill Coding Practices
Error
- Location
x402-MCP.md:136- Finding
Automatic Wallet Signing Lacks Payment and Network Restrictions
- Content
View full analysis
- Remediation
View remediation
Security audit
Openclaw X402 Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill is clearly meant for x402 service discovery and payments, but it asks users to give agents persistent wallet signing authority with incomplete payment controls.
Install only if you are comfortable giving the agent wallet signing authority. Use a dedicated low-balance wallet, testnet first, avoid putting valuable private keys in .env or desktop config files, verify each endpoint and price before payment, and do dependency installation in an isolated environment before adding wallet secrets.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
x402-MCP.md:79- Finding
Raw Wallet Private Keys Are Stored in Persistent Plaintext Configuration
- Content
View full analysis
/examples/typescript/clients/mcp", "dev" ], "env": { "EVM_PRIVATE_KEY": "", "SVM_PRIVATE_KEY": "", "RESOURCE_SERVER_URL": "http://localhost:4021", "ENDPOINT_PATH": "/weather" } } } } ``` Related plaintext `.env` instructions also appear at `README.md:258-266`: ```bash # Create .env file cat > .env << EOF EVM_PRIVATE_KEY="0xYourPrivateKeyHere" MAX_SPEND_PER_CALL=0.10 BASE_RPC_URL="https://mainnet.base.org" EOF ``` ### Technical Analysis The documentation directs users to place complete EVM and Solana private keys in Claude Desktop configuration or project `.env` files. These are persistent plaintext files rather than dedicated secret stores. Excluding `.env` from version control reduces accidental Git disclosure but does not protect the credential from: - Other local processes running as the same user - Broad or inherited file permissions - Desktop configuration synchronization - Filesystem and cloud backups - Support bundles or accidental configuration sharing - Malware or compromised dependencies - Editors, shell history, or diagnostic tooling A wallet private key is a bearer credential. Anyone who obtains it can generally import the wallet and authorize transactions without requiring access to the original system. Raw private-key access is not the minimum privilege needed when an external signer, operating-system credential vault, or hardware-backed wallet can authorize narrowly scoped transactions. ### Attack Path 1. The user follows the setup gui ...[truncated 1104 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
x402-MCP.md:55- Finding
Installation Instructions Execute Mutable and Unaudited Remote Dependencies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (38)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
pip install -r requirements.txt
(Optional) Set up environment for paid calls
cp .env.example .env
Edit .env and add your EVM_PRIVATE_KEY
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
(Optional) Set up environment for paid calls
cp .env.example .env
Edit .env and add your EVM_PRIVATE_KEY
text ### Your First Query
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
(Optional) Set up environment for paid calls
cp .env.example .env
Edit .env and add your EVM_PRIVATE_KEY
text ### Your First Query
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
(Optional) Set up environment for paid calls
cp .env.example .env
Edit .env and add your EVM_PRIVATE_KEY
text ### Your First Query
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
(Optional) Set up environment for paid calls
cp .env.example .env
Edit .env and add your EVM_PRIVATE_KEY
text ### Your First Query
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
(Optional) Set up environment for paid calls
cp .env.example .env
Edit .env and add your EVM_PRIVATE_KEY
text ### Your First Query
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
(Optional) Set up environment for paid calls
cp .env.example .env
Edit .env and add your EVM_PRIVATE_KEY
text ### Your First Query
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
(Optional) Set up environment for paid calls
cp .env.example .env
Edit .env and add your EVM_PRIVATE_KEY
text ### Your First Query
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 74% confidence
- Finding
The README instructs users to place a raw blockchain private key in a plaintext .env file to enable autonomous paid calls. In an agent/skill ecosystem, this materially increases compromise risk because local secrets may be exposed through misconfiguration, logs, backups, directory syncing, or other tools with filesystem access; the skill context makes this more dangerous because the key directly authorizes spending.
- Content
- Configure environment:
bash # Create .env file cat > .env << EOF EVM_PRIVATE_KEY="0xYourPrivateKeyHere" MAX_SPEND_PER_CALL=0.10
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 74% confidence
- Finding
This example continues the plaintext .env setup containing EVM_PRIVATE_KEY and normalizes a high-risk secret-handling pattern for a tool that can autonomously spend funds. The danger is amplified by the financial capability of the key and by likely deployment in agent environments where multiple components may access local files.
- Content
- Configure environment:
bash # Create .env file cat > .env << EOF EVM_PRIVATE_KEY="0xYourPrivateKeyHere" MAX_SPEND_PER_CALL=0.10 BASE_RPC_URL="https://mainnet.base.org"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The skill metadata advertises that use of the paid features requires EVM_PRIVATE_KEY in .env, normalizing direct raw-key exposure as an operational prerequisite. For a payments skill, this materially raises the blast radius of any local compromise, accidental disclosure, prompt-induced file exposure, or logging issue because the secret controls spendable on-chain funds.
- Content
md --- name: openclaw-x402-skill description: "Discover, browse, filter, and pay for x402-compatible API endpoints and MCP tools from the x402 Bazaar — the autonomous discovery layer for agentic payments. Browse all available services, filter by price or type, inspect payment requirements, and call any discovered endpoint using USDC micropayments on Base with no API keys or account setup. Use when the agent needs to find a payable API service, check what x402 services exist for a given task (web scraping, AI inference, weather data, market data), pay for a single API call via x402, or list services under a given price threshold. Requires EVM_PRIVATE_KEY in .env (Base wallet with USDC) for paid calls. Discovery browsing requires no keys at all." metadata: openclaw: emoji: "🛒"
MCP Config Access
High
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
- Content
Filter by type
bash python3 agent.py "list http services" python3 agent.py "list mcp tools"Inspect a specific service
MCP Config Access
High
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
- Content
Filter by type
bash python3 agent.py "list http services" python3 agent.py "list mcp tools"Inspect a specific service
MCP Config Access
High
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
- Content
Filter by type
bash python3 agent.py "list http services" python3 agent.py "list mcp tools"Inspect a specific service
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
The troubleshooting guidance tells users to add EVM_PRIVATE_KEY to .env, again encouraging placement of a highly sensitive secret into a commonly mishandled file. Repetition in operational guidance makes unsafe key-management practices more likely and broadens the chance of accidental disclosure during support, screenshots, copying commands, or repository use.
- Content
md | Error | Cause | Fix | |---|---|---| | `EVM_PRIVATE_KEY not set` | Missing .env key | Add key to .env (only needed for paid calls) | | `Insufficient USDC balance` | Wallet underfunded | Bridge USDC to Base at bridge.base.org | | `Spend limit exceeded` | Service costs more than MAX_SPEND_PER_CALL | Raise limit in .env or confirm manually | | `402 verification failed` | Facilitator rejected payment | Retry or switch facilitator |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 69% confidence
- Finding
This finding is likely triggered because the table also references .env for MAX_SPEND_PER_CALL, which is a non-secret configuration value. Unlike the private key guidance, storing a spending-limit variable in .env is not credential access and does not itself expose sensitive authentication material.
- Content
md |---|---|---| | `EVM_PRIVATE_KEY not set` | Missing .env key | Add key to .env (only needed for paid calls) | | `Insufficient USDC balance` | Wallet underfunded | Bridge USDC to Base at bridge.base.org | | `Spend limit exceeded` | Service costs more than MAX_SPEND_PER_CALL | Raise limit in .env or confirm manually | | `402 verification failed` | Facilitator rejected payment | Retry or switch facilitator | | `No services found` | Empty Bazaar result | Broaden search or try again later | | `Network mismatch` | Service on unsupported chain | Filter by network eip155:8453 |
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README explicitly promotes autonomous paid calls and natural-language workflows that can send user prompts, URLs, and task data to third-party x402 services, but it does not clearly warn that sensitive user data may leave the local environment. In an agent setting, this omission is security-relevant because users may assume the skill only performs local discovery/payment orchestration while actually transmitting prompts and potentially confidential content to external providers.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This example instructs users to call a third-party endpoint directly and sits in the paid-execution section, where prompts and parameters are sent externally and payment is initiated. In the context of an agent skill, encouraging outbound calls without an explicit warning about data disclosure, untrusted remote services, and financial side effects is a real security concern.
- Content
bash # Call a specific endpoint python3 agent.py "call https://api.weather-x402.com/current?location=NYC" # Pay and call with natural language python3 agent.py "use x402 to get weather for London"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
ENABLE_DEBUG=false # Enable debug logging (default: false)
Facilitator endpoints (advanced)
FACILITATOR_CDP="https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources" FACILITATOR_PAYAI="https://facilitator.payai.network/discovery/resources"
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs users to export a wallet private key and place it in a local .env file without prominently warning that this credential grants direct control over funds. Encouraging routine handling of raw private keys materially increases the risk of theft through accidental exposure, logging, backup leakage, repository commits, or compromise of the host running the skill.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Inspect a specific service
bash python3 agent.py "inspect https://api.example.com/x402/weather"Call a discovered service (requires EVM_PRIVATE_KEY + USDC)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Inspect a specific service
bash python3 agent.py "inspect https://api.example.com/x402/weather"Call a discovered service (requires EVM_PRIVATE_KEY + USDC)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Inspect a specific service
bash python3 agent.py "inspect https://api.example.com/x402/weather"Call a discovered service (requires EVM_PRIVATE_KEY + USDC)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Inspect a specific service
bash python3 agent.py "inspect https://api.example.com/x402/weather"Call a discovered service (requires EVM_PRIVATE_KEY + USDC)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This example instructs the agent to call an arbitrary external x402 endpoint, which in the context of this skill can trigger an outbound paid request using the user's wallet. Because the skill is explicitly designed for autonomous payment to discovered or user-supplied endpoints, insufficient validation of destination trust or payment terms can lead to unintended spending, interaction with malicious APIs, or induced purchases.
- Content
Call a discovered service (requires EVM_PRIVATE_KEY + USDC)
bash python3 agent.py "call https://api.example.com/x402/weather?location=NYC" python3 agent.py "pay and call https://api.example.com/x402/sentiment"