T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:20
- Finding
- Unbounded Automatic USDC Payment for API Requests## Vulnerability Details **File Location**: `SKILL.md`, lines 20–21 **Vulnerability Type**: Automatic cryptocurrency spending without explicit approval or defined limits **Risk Level**: Medium **Complete Code Snippet**: ```markdown ## How it's paid (x402) Plain HTTPS GET. First call returns HTTP 402; your wallet auto-pays the USDC fee and retries → JSON. ``` ### Technical Analysis The skill specifies that an agent-connected wallet automatically pays an HTTP 402 payment request and retries the API call. Although the document discloses approximate per-call prices, it does not require explicit user confirmation before payment and does not define a per-request limit, cumulative session budget, maximum retry count, wallet balance check, or duplicate-payment protection. Consequently, any workflow capable of invoking this skill repeatedly may cause multiple cryptocurrency transactions without the user approving each charge. The risk is especially relevant when invocation parameters or call frequency can be influenced by untrusted prompts, external content, automated loops, or retry behavior. The reviewed project contains only `SKILL.md`; no executable implementation of the wallet or payment mechanism was present. Therefore, the practical severity depends on the host agent's x402 wallet configuration and its independent spending safeguards. ### Attack Path 1. A user loads the skill in an environment with an x402-compatible wallet authorized to make automatic USDC payments. 2. An attacker-controlled prompt, untrusted task, or defective automation causes repeated repository, release, user, audit, or gist lookups. 3. The external API responds to each initial request with HTTP 402. 4. Following the skill's stated behavior, the wallet automatically pays the requested fee and retries each call. 5. In the absence of a payment confirmation step, session budget, call limit, or retry ceiling, repeated invocations accumulate unintended U ...[truncated 538 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit, informed user approval before every payment. Display the exact amount, currency, recipient, endpoint, and operation before authorization. 2. Support a user-configured maximum price per call and cumulative session budget. Reject payments exceeding either threshold. 3. Enforce a strict maximum number of paid calls and payment retries per operation and per session. 4. Disable automatic payment by default; permit it only through an explicit opt-in configuration. 5. Add duplicate-payment and idempotency protections so network retries cannot produce multiple charges for one logical request. 6. Validate the HTTPS destination and payment recipient against an immutable allowlist before authorizing funds. 7. Stop processing when the quoted price differs from the documented or user-approved amount. 8. Maintain a visible transaction log and notify the user of cumulative expenditure during the session. 9. Document cancellation behavior and ensure that insufficient funds, malformed HTTP 402 responses, or unexpected payment demands fail closed without retrying indefinitely.