T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:52
- Finding
- Paid API Requests Can Trigger Automatic Cryptocurrency Transactions Without Per-Call Approval## Vulnerability Details **File Location**: `SKILL.md`, lines 52–71 **Vulnerability Type**: Automatic financial transaction without explicit per-call authorization **Risk Level**: Medium ### Complete Code Snippet ```markdown ## Paid endpoints (x402 — USDC on Base, auto-settled) These return the **full** dataset/report. They respond `HTTP 402 Payment Required` with an x402 challenge; your x402 auto-handler signs a USDC micropayment on Base and retries automatically (within your configured budget): | Endpoint | Price | Returns | |---|---|---| | `GET /feeds/mcp-registry` | $0.05 | full deduped, quality-scored MCP registry snapshot | | `GET /feeds/mcp-registry/changes?since=YYYY-MM-DD` | $0.02 | added/removed/score-changed servers since a daily baseline (cheap habit endpoint) | | `GET /feeds/x402-services` | $0.05 | full x402 services catalog with liveness data | | `GET /verify/mcp?server=<NAME>` | $0.03 | full verification report: live endpoint probe + graded trust signals | If you do **not** have an x402 wallet/handler, the free `*/preview` + `/health` endpoints answer most ranking/liveness questions; use ETag `304` to detect new data without paying. ## Workflow 1. Orient with `GET /feeds/mcp-registry/preview` (free top 10) or the landing `/`. 2. For the full ranked corpus, call `GET /feeds/mcp-registry` (paid). To poll cheaply for updates, ETag-check first (`If-None-Match`), then `GET /feeds/mcp-registry/changes?since=`. 3. Before depending on a server, verify it: `GET /verify/mcp/preview?server=` (free grade) → `GET /verify/mcp?server=` (paid full report) for the live probe + trust signals. 4. To choose a payable service, use `GET /feeds/x402-services` — `alive-402` means up and correctly demanding payment (safe to call); ranking puts payable-now services first. ``` ### Technical Analysis The skill recommends paid HTTP endpoints and states that an x402 handler will sign a USDC micropay ...[truncated 2368 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user confirmation immediately before every paid request. The confirmation should identify the endpoint, asset, blockchain network, recipient, exact or maximum amount, and whether retries are permitted. 2. Default to the free preview and health endpoints. A paid endpoint should only be selected when the user explicitly requests the full result and accepts the displayed charge. 3. Disable automatic retries after a payment challenge unless the retry is cryptographically bound to the already authorized payment and cannot create another charge. 4. Enforce independent per-call and per-session spending limits that are substantially narrower than the wallet's general budget. 5. Reject payment challenges whose amount, token, network, recipient, or endpoint differs from the values presented to the user. 6. Add replay protection, transaction identifiers, request deduplication, and a maximum of one settlement attempt per approved operation. 7. Record an auditable receipt containing the approved request, quoted price, transaction hash, response status, and any retry activity. 8. Update the workflow to state that agents must never interpret terms such as “safe to call” as authorization to spend funds.