Security audit

EarnFi x402 - Execute real-world human work and social engagement (feedback, opinions, data labelling, reviews, small tasks), social tasks (likes, followers, reposts, raids, comments, youtube views, etc.) — all paid via x402

Security checks for vulnerabilities and agentic risk

Overview

This skill openly supports paid human and social-engagement jobs, but it combines money movement, social boosting, mutable installs, and bearer-token handling in ways users should review carefully.

Install only if you are comfortable with a skill that can initiate paid USDC-backed human work and social engagement. Require explicit confirmation before every paid job or social boost, avoid sending private or sensitive content in job instructions, keep agent_token and per-job secrets out of logs and URLs where possible, and prefer pinned, verified install steps over the mutable curl/npx examples.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:84
Finding: Mutable Remote Packages and Skill Content Are Installed Without Version or Integrity Verification
Content: View full analysis
~/.openclaw/skills/earnfi-x402/SKILL.md curl -s "https://app.earnfi.fun/skill.json" > ~/.openclaw/skills/earnfi-x402/package.json ``` ```text For automated discovery smoke tests you can use: npx -y @agentcash/discovery@latest discover "https://app.earnfi.fun" ``` ```bash npm install @x402/fetch @x402/core @x402/svm # Solana ``` ### Technical Analysis The installation instructions retrieve mutable Skill files from a remote server and overwrite local files without verifying a cryptographic signature, checksum, expected version, or content digest. The `curl -s` option also suppresses diagnostic output and does not make HTTP failures fatal. The command using `npx -y @agentcash/discovery@latest` is particularly sensitive because it automatically downloads and executes the package currently published under the `latest` tag. The effective package contents can change after this Skill has been reviewed. The `-y` option suppresses the normal installation confirmation. The x402 packages are also installed without exact versions. Dependency resolution can therefore change over time and may introduce compromised or incompatible transitive dependencies. Package installation can execute npm lifecycle scripts with the privileges of the user running the command. No evidence shows that the currently referenced packages or host are malicious. The vulnerability is the absence of controls preventing a future registry, publisher-account, DNS, TLS termination, or hosting compromise from changing the installed payload. ### Attack Path 1. An attacker compromises the EarnFi hosting environment, a referenced npm publisher account, or the package distribution chain. 2. The attacker replaces a hosted Skill file or publishe ...[truncated 1230 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:249
Finding: Bearer Credentials Are Transmitted in URL Query Strings and May Be Persisted Insecurely
Content: View full analysis
Remediation: View remediation
``` 2. Use separate, explicitly named headers if the server must distinguish agent tokens from per-job secrets. 3. Remove secrets from all URLs, curl examples, heartbeat instructions, and status URLs returned by the service. 4. Use POST or another appropriate non-GET method for state-changing actions such as pausing jobs, approving or rejecting submissions, and selecting winners. 5. Configure API gateways, proxies, application servers, observability systems, and agent tooling to redact authorization headers and legacy credential query parameters. 6. Store credentials in an operating-system credential manager or encrypted secret store. If a state file is unavoidable, create it with owner-only permissions such as `0600`. 7. Keep job metadata and credentials in separate files so non-sensitive state can be logged or backed up without copying bearer tokens. 8. Define token expiration, narrow per-token scopes, revocation, rotation, and recovery mechanisms. Per-job secrets should only authorize read operations for one job. 9. Prevent secrets from appearing in shell history or command-line arguments. Read them from a protected credential source at runtime. 10. Add automated tests ensuring credentials are rejected when supplied in URLs once header-based authentication is available. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
Install locally (OpenClaw):

bash
mkdir -p ~/.openclaw/skills/earnfi-x402 curl -s "https://app.earnfi.fun/skill.md" > ~/.openclaw/skills/earnfi-x402/SKILL.md curl -s "https://app.earnfi.fun/skill.json" > ~/.openclaw/skills/earnfi-x402/package.json

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
bash
mkdir -p ~/.openclaw/skills/earnfi-x402 curl -s "https://app.earnfi.fun/skill.md" > ~/.openclaw/skills/earnfi-x402/SKILL.md curl -s "https://app.earnfi.fun/skill.json" > ~/.openclaw/skills/earnfi-x402/package.json

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The activation guidance is very broad, telling the agent to use the skill whenever it needs opinions, feedback, review, or subjective answers. In context, invoking this skill can spend real money and send tasks to external humans, so overly broad triggers can cause unintended paid actions, privacy leaks in prompts, or policy-violating outsourcing of user content.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The social-task guidance encourages use for boosting posts, growing accounts, and increasing engagement, which can steer the agent toward paid manipulation of social metrics. Because the skill directly facilitates social actions like likes, follows, comments, and views, broad invocation criteria materially increase the risk of spam, platform abuse, and unauthorized spending on reputation-manipulation services.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The 'Identity programming' section states 'You are an EarnFi agent,' which imposes a specific role identity on the agent. This is a natural-language policy concern because it forces a preset persona rather than offering role choice or limiting it to internal implementation context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.