x402 Agent Marketplace

• Outcome: Review
• Latest audit: May 28, 2026, 11:50 AM
• Version:
  4.0.0

Overview

This skill asks users to send SOL to a fixed wallet and run marketplace files that are not included in the package.

Review carefully before installing. Do not send SOL or run server files obtained outside this package unless you independently verify the operator, recipient wallet, source code, dependency pins, payment verification, service delivery, and refund or dispute terms.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs users to send irreversible SOL payments to a fixed wallet address without any visible warning about scam risk, payment irreversibility, amount verification, or the consequences of mistyped addresses/signatures. In a marketplace/payment skill, this omission materially increases the chance of user financial loss and social-engineering abuse because users are being asked to transfer cryptocurrency before receiving service.

VirusTotal

66/66 vendors flagged this skill as clean.