ClawHub
Back to skill

Security audit

x402card Virtual Card

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for managing x402card virtual cards, but its one-line remote shell installer is a real supply-chain risk for a wallet/payment tool.

Before installing, avoid running the pipe-to-shell command blindly. Prefer a source checkout or a versioned release with verifiable checksums/signatures, inspect the installer first, and use a wallet/signer with limited funds and explicit confirmation for each payment action.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Script Fetching

High
Category
Supply Chain
Content
# x402card agent

Install the public CLI with `curl -sSL https://x402card.org/install | sh`, or use the local runtime in `packages/agent` from a source checkout. Use the public MCP only for discovery because it has no wallet authority.

## Safe workflow
Confidence
98% confidence
Finding
The skill recommends installing software with `curl ... | sh`, which executes a remote script directly in the user's shell without prior inspection or integrity verification. If the site, CDN, DNS, TLS termination, or publish pipeline is compromised, an attacker can achieve immediate arbitrary code execution on the host, potentially stealing wallet material, environment secrets, or modifying transaction tooling.

Static analysis

No suspicious patterns detected.