ClawHub
Back to skill

Security audit

openkrill

Security checks for vulnerabilities and agentic risk

Overview

This payments skill is not clearly malicious, but it needs Review because it can spend funds through broad x402 payment calls and also creates and reads disposable email accounts while storing their credentials locally.

Install only after reviewing whether you want an agent to spend from a thirdweb-backed wallet and create/read disposable inboxes. Use a low-funded wallet, require explicit approval for every payment, set and enforce spending caps outside this skill, avoid arbitrary x402 URLs, and do not use the disposable-email feature for sensitive accounts unless credential storage is fixed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/fetch-with-payment.ts:44
Finding

Automatic Payment Requests Do Not Enforce a Mandatory Spending Limit or Destination Allowlist

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/create-email.ts:24
Finding

Disposable Email Passwords and Bearer Tokens Are Persisted in a Plaintext File Without Restrictive Permissions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/create-email.ts:65
Finding

Email Authentication Passwords Are Generated with a Non-Cryptographic PRNG and Exposed to Process Output

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:270
Finding

Documented npx Execution Can Download and Run Unpinned Third-Party Code with Access to Skill Secrets

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (133)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill claims to handle x402 micropayments, but also includes unrelated disposable email account creation, token retrieval, inbox access, and local credential storage. This scope expansion can mislead agents into performing account-creation and credential-handling actions the user did not authorize under the guise of a payments skill.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill claims to handle x402 micropayments, but also includes unrelated disposable email account creation, token retrieval, inbox access, and local credential storage. This scope expansion can mislead agents into performing account-creation and credential-handling actions the user did not authorize under the guise of a payments skill.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The skill claims to handle x402 micropayments, but also includes unrelated disposable email account creation, token retrieval, inbox access, and local credential storage. This scope expansion can mislead agents into performing account-creation and credential-handling actions the user did not authorize under the guise of a payments skill.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill claims to handle x402 micropayments, but also includes unrelated disposable email account creation, token retrieval, inbox access, and local credential storage. This scope expansion can mislead agents into performing account-creation and credential-handling actions the user did not authorize under the guise of a payments skill.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The skill claims to handle x402 micropayments, but also includes unrelated disposable email account creation, token retrieval, inbox access, and local credential storage. This scope expansion can mislead agents into performing account-creation and credential-handling actions the user did not authorize under the guise of a payments skill.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill claims to handle x402 micropayments, but also includes unrelated disposable email account creation, token retrieval, inbox access, and local credential storage. This scope expansion can mislead agents into performing account-creation and credential-handling actions the user did not authorize under the guise of a payments skill.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill claims to handle x402 micropayments, but also includes unrelated disposable email account creation, token retrieval, inbox access, and local credential storage. This scope expansion can mislead agents into performing account-creation and credential-handling actions the user did not authorize under the guise of a payments skill.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 271)May include surrounding context.

md
npx ts-node scripts/discover-services.ts

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.

md
npx ts-node scripts/discover-services.ts

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

md
npx ts-node scripts/discover-services.ts

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.

md
npx ts-node scripts/discover-services.ts

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The instructions explicitly recommend adding THIRDWEB_SECRET_KEY to .env.local or a shell profile, normalizing storage of a payment-capable secret in plaintext developer-managed locations. In the context of a micropayments skill, compromise of this credential could enable unauthorized API usage, wallet control, spending, and downstream financial abuse.

Content

Scanner excerpt · assets/config-template.json (reported line 77)May include surrounding context.

json
"step": 2,
        "action": "Set environment variable",
        "command": "export THIRDWEB_SECRET_KEY='your-key-here'",
        "description": "Add to .env.local or shell profile"
      },
      {
        "step": 3,

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file implements disposable email account creation and inbox management, which is unrelated to the stated skill purpose of x402 micropayments. Capability mismatch is dangerous because it can hide unauthorized account creation, OTP interception, and identity-abuse functionality inside a package users would not reasonably expect to manipulate email accounts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code actively creates disposable addresses, authenticates to a third-party mailbox service, refreshes tokens, lists messages, and reads message contents. In the context of a micropayments skill, this unjustified capability can be abused to register throwaway accounts and capture verification emails or recovery links, significantly expanding the skill's power beyond payments into covert account operations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill requires sensitive capabilities (env access to THIRDWEB_SECRET_KEY and unrestricted network access) but does not declare an explicit tool scope such as permissions or allowed-tools. That makes the operational boundary ambiguous and increases the chance an agent can use broader tools than intended while handling payments and external API calls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill promotes automatic payment flows and opening funding links but does not clearly warn that these actions may spend real funds or send users to third-party payment pages. In an autonomous-agent context, that can lead to unintended purchases or social-engineering-like redirection under the authority of the skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

bash
# Query the Bazaar to see what's available (no auth required)
curl -s "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources?type=http&limit=50"

Prerequisites

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

bash
# Query the Bazaar to see what's available (no auth required)
curl -s "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources?type=http&limit=50"

Prerequisites

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

bash
# Query the Bazaar to see what's available (no auth required)
curl -s "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources?type=http&limit=50"

Prerequisites

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/API-REFERENCE.md (reported line 234)May include surrounding context.

bash
# Query the Bazaar to see what's available (no auth required)
curl -s "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources?type=http&limit=50"

Prerequisites

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/API-REFERENCE.md (reported line 308)May include surrounding context.

bash
# Query the Bazaar to see what's available (no auth required)
curl -s "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources?type=http&limit=50"

Prerequisites

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/discover-services.ts (reported line 64)May include surrounding context.

ts
```bash
# Query the Bazaar to see what's available (no auth required)
curl -s "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources?type=http&limit=50"
```

## Prerequisites

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
**Discovery tips:**
- Check for `x402.` subdomain (e.g., `x402.browserbase.com`)
- Check for `/x402/` in the path (e.g., `/v1/x402/search`)
- Hit the x402 root URL for endpoint listing (e.g., `curl https://x402.browserbase.com/`)

## Core Workflow

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

This example sends the sensitive THIRDWEB_SECRET_KEY to thirdweb to create a server wallet. While this may be intended, it is high-trust external transmission of a secret-bearing request and can create managed wallets capable of spending funds if an agent executes it without strict authorization.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

Use the thirdweb API directly (recommended):

bash
curl -s -X POST https://api.thirdweb.com/v1/wallets/server \
  -H "Content-Type: application/json" \
  -H "x-secret-key: $THIRDWEB_SECRET_KEY" \
  -d '{"identifier": "x402-agent-wallet"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

This call transmits a secret-authenticated payment request to thirdweb that can cause paid actions against Browserbase. Because it combines external transmission, authenticated access, and monetary effect, it is more dangerous than ordinary network usage in this skill context.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

bash
# Browserbase - Create browser session
curl -s -X POST "https://api.thirdweb.com/v1/payments/x402/fetch?url=https://x402.browserbase.com/browser/session/create&method=POST" \
  -H "Content-Type: application/json" \
  -H "x-secret-key: $THIRDWEB_SECRET_KEY" \
  -d '{"browserSettings": {"viewport": {"width": 1920, "height": 1080}}}'

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/create-email.ts:133