x402card Virtual Card

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:03 AM UTC
• Version: 1.1.0

Overview

The skill is coherent and safety-conscious for wallet-owned card operations, but its unverified curl-to-shell installer is too powerful for a financial/wallet tool without pinning or integrity checks.

Review before installing. The card/payment workflow itself includes reasonable confirmation and validation steps, but do not run the documented `curl | sh` installer unless you independently trust the publisher and delivery path; prefer an auditable, pinned, checksum- or signature-verified release.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:8

Finding

Unverified Remote Installer Executed Directly by the Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 8
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code Snippet:

markdown

Install the public CLI with `curl -sSL https://x402card.org/install | sh`, or use the local runtime in `packages/agent` from a source checkout. Use the public MCP only for discovery because it has no wallet authority.

Technical Analysis

The installation command downloads content from an external URL and sends it directly to sh. The remote response is executed before the user can inspect it, and the command provides no version pinning, checksum validation, or cryptographic signature verification. HTTPS protects the connection in transit but does not establish that the returned script is a reviewed or immutable artifact.

The effective installer can change after this Skill has been audited. Compromise of the remote server, hosting account, DNS resolution, or associated release process could therefore turn this instruction into arbitrary command execution. The -s option also suppresses normal curl progress and error output, reducing visibility during installation.

This behavior exceeds the minimum privileges needed to document or use the declared API workflow: the remote response receives general shell execution authority under the invoking account. The repository contains no copy of the installer that could be audited and no integrity metadata with which to authenticate it.

Attack Path

1. A user or agent follows the installation instruction in SKILL.md.
2. curl requests the current response from https://x402card.org/install.
3. The endpoint or its delivery chain serves a malicious or compromised shell script.
4. The pipe passes the response directly to sh without inspection or integrity verification.
5. The script executes with the permissions and environment of the invoking user.
6. It can access or alter resou ...[truncated 838 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct curl | sh installation pattern.
2. Publish the CLI as a versioned, immutable release through a trustworthy package or release channel.
3. Pin the documented installation command to a specific version rather than a mutable endpoint.
4. Provide a SHA-256 checksum or, preferably, a cryptographic signature whose verification key is distributed through a separate trusted channel.
5. Require users to download the artifact first, verify its integrity and signature, and optionally inspect it before execution.
6. Avoid requesting administrator privileges unless a documented installation step strictly requires them.
7. Include the relevant installer or runtime source in the reviewed repository so its behavior can be audited.
8. Document the exact files, commands, network destinations, and permissions used during installation.

A safer conceptual workflow is:

sh

curl --fail --show-error --location --output installer.sh \
  https://example.invalid/releases/x402card-agent-VERSION/install.sh
echo "PINNED_SHA256  installer.sh" | sha256sum --check -
less installer.sh
sh installer.sh

The actual release URL, version, and checksum must come from a trusted, independently verifiable source.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The installation instruction pipes a remotely fetched shell script directly into sh, which enables arbitrary code execution from the network without integrity verification, review, or pinning. In this skill's context, that is especially dangerous because the tool is related to wallet/card operations and could steal keys, tamper with signer commands, alter payment destinations, or exfiltrate sensitive card/owner data.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

# x402card agent

Install the public CLI with `curl -sSL https://x402card.org/install | sh`, or use the local runtime in `packages/agent` from a source checkout. Use the public MCP only for discovery because it has no wallet authority.

## Safe workflow

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill description is broadly framed around discovering, issuing, topping up, and managing a wallet-owned virtual card, which could cause an agent to invoke it in a wide range of money-moving contexts without strong gating. In a financial/payment skill, vague triggers increase the chance of unintended payment flows, card issuance, or top-ups being initiated when the user did not clearly request those actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

## Safe workflow

1. Read `https://api.x402card.org/api/card/discovery`, `https://api.x402card.org/api/agent`, and runtime config before a money action.
2. Obtain explicit approval for the fixed economics: the wallet pays 25 USDC on Base, the card starts at $25, the platform fee is $10, and the expected available balance is $15.
3. Generate one stable idempotency key. POST it to `https://api.x402card.org/api/card/purchase` without `PAYMENT-SIGNATURE`; this returns a 402 challenge and does not charge the wallet.
4. Validate x402 v2, scheme `exact`, Base `eip155:8453`, native Base USDC, amount `25000000`, the expected payee, and resource `/api/card/purchase`.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

## Safe workflow

1. Read `https://api.x402card.org/api/card/discovery`, `https://api.x402card.org/api/agent`, and runtime config before a money action.
2. Obtain explicit approval for the fixed economics: the wallet pays 25 USDC on Base, the card starts at $25, the platform fee is $10, and the expected available balance is $15.
3. Generate one stable idempotency key. POST it to `https://api.x402card.org/api/card/purchase` without `PAYMENT-SIGNATURE`; this returns a 402 challenge and does not charge the wallet.
4. Validate x402 v2, scheme `exact`, Base `eip155:8453`, native Base USDC, amount `25000000`, the expected payee, and resource `/api/card/purchase`.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

## Safe workflow

1. Read `https://api.x402card.org/api/card/discovery`, `https://api.x402card.org/api/agent`, and runtime config before a money action.
2. Obtain explicit approval for the fixed economics: the wallet pays 25 USDC on Base, the card starts at $25, the platform fee is $10, and the expected available balance is $15.
3. Generate one stable idempotency key. POST it to `https://api.x402card.org/api/card/purchase` without `PAYMENT-SIGNATURE`; this returns a 402 challenge and does not charge the wallet.
4. Validate x402 v2, scheme `exact`, Base `eip155:8453`, native Base USDC, amount `25000000`, the expected payee, and resource `/api/card/purchase`.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

## Safe workflow

1. Read `https://api.x402card.org/api/card/discovery`, `https://api.x402card.org/api/agent`, and runtime config before a money action.
2. Obtain explicit approval for the fixed economics: the wallet pays 25 USDC on Base, the card starts at $25, the platform fee is $10, and the expected available balance is $15.
3. Generate one stable idempotency key. POST it to `https://api.x402card.org/api/card/purchase` without `PAYMENT-SIGNATURE`; this returns a 402 challenge and does not charge the wallet.
4. Validate x402 v2, scheme `exact`, Base `eip155:8453`, native Base USDC, amount `25000000`, the expected payee, and resource `/api/card/purchase`.