T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/fluxa-cli.bundle.js:544- Finding
Undocumented Direct-Payout Capability Exceeds the Skill's Declared Privileges
- Content
View full analysis
Recipient address (required) --amount Amount in smallest units (required) --id Unique payout ID (required) --network Network (default: base) --asset Asset contract address (default: USDC) ``` ```javascript async function cmdPayout(options) { const toAddress = options.to; const amount = options.amount; const payoutId = options.id; const network = options.network || DEFAULT_NETWORK; const assetAddress = options.asset || DEFAULT_ASSET; if (!toAddress || !amount || !payoutId) { return { success: false, error: "Missing required parameters: --to, --amount, --id" }; } if (!/^0x[a-fA-F0-9]{40}$/.test(toAddress)) { return { success: false, error: "Invalid recipient address format" }; } if (!/^\d+$/.test(amount)) { return { success: false, error: "Amount must be a positive integer (smallest units)" }; } const auth = await ensureValidJWT(); if (!auth) { return { success: false, error: 'FluxA Agent ID not initialized. Run "init" first.' }; } const currency = getCurrencyFromAsset(assetAddress, network); try { const result = await createPayout( { agentId: auth.agent_id, toAddress, amount, currency, network, assetAddress, payoutId }, auth.jwt ); await recordAudit({ event: "payout_request", payout_id: payoutId, to: toAddress, amount, status: result.status }); return { success: true, dat ...[truncated 2356 chars]- Remediation
View remediation