ClawHub
Back to skill

Security audit

x402 Agentic Creation

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-aligned, but it needs review because it can sign wallet messages and trigger USDC withdrawals without strong in-skill safeguards.

Install only if you trust the GateX402 backend and can run the skill with strict host controls: keep wallet keys in a vault, use a limited wallet/session policy, require explicit human approval before withdrawals, pin the installer path, and update the flagged dependencies before using it in CI or production.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
src/tools/provision.ts:36
Finding

Blind Signing of Unvalidated Server-Controlled Messages

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
src/tools/withdraw.ts:50
Finding

Backend-Controlled Strings Are Returned to the Agent Without Content Neutralization

Content
View full analysis
", end: "", }; export function wrapAgentResponse(data: T): string { return `${GATEX402_BOUNDARY.start}\n${JSON.stringify(data)}\n${GATEX402_BOUNDARY.end}`; } ``` ### Technical Analysis The implementation describes these responses as sanitized, but backend-controlled `message` and `status` values are accepted based only on their JavaScript type. Their content, length, character set, and permitted values are not validated. Wrapping JSON in HTML comment markers labels the output but does not neutralize natural-language instructions. It also does not guarantee that an LLM-based Agent will treat the content exclusively as data. Because the remote strings may contain arbitrary text, a compromised backend can return instructions designed to alter subsequent Agent behavior. JSON serialization prevents the remote value from directly breaking JSON syntax through ordinary quoting, but it does not prevent semantic prompt injection. The fixed boundaries sim ...[truncated 1409 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
README.md:25
Finding

Optional Installation Instructions Execute an Unpinned Package Through npx

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (23)

Known Vulnerable Dependency: vitest==4.0.18 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical
Category
Supply Chain
Confidence
98% confidence
Finding

vitest 4.0.18 is present and carries critical-severity advisories involving arbitrary file read and possible execution when the Vitest UI server is listening. While this is a dev dependency rather than demonstrated production code, the finding is still genuine and could compromise developer or CI environments if test UI features are enabled or exposed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vitest==4.0.18 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical
Category
Supply Chain
Confidence
97% confidence
Finding

The manifest includes vitest 4.0.18, which is flagged as affected by critical advisories involving arbitrary file read and possible execution when the Vitest UI server or mocker functionality is exposed. Although Vitest is a devDependency, development and CI environments often process untrusted repository content, so vulnerable test tooling can still become a serious attack path, especially in a monetization/payment-related skill where secrets, wallets, and CI tokens may be present.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High
Category
Supply Chain
Confidence
90% confidence
Finding

nanoid 3.3.11 is present transitively via development tooling, and the cited flaws can cause hangs or overflow-related instability under crafted inputs. Even though this is not clearly used in the skill's runtime payment path, vulnerable build/test dependencies can still enable denial of service in development, CI, or tooling-driven workflows.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: picomatch==4.0.3 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High
Category
Supply Chain
Confidence
93% confidence
Finding

picomatch 4.0.3 is a real vulnerable dependency with reported method-injection and ReDoS issues under attacker-controlled glob patterns. In this skill it appears only in developer tooling, so exploitation would typically require untrusted input reaching build/test file-matching logic, making the practical risk lower than a production parser but still valid.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.6 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High
Category
Supply Chain
Confidence
90% confidence
Finding

postcss 8.5.6 is a known vulnerable version with advisories including arbitrary file read and XSS-related issues. Here it is part of Vite's dev toolchain rather than an obvious production execution path, but if this skill is developed or previewed with exposed tooling, the vulnerability could still affect maintainers or CI systems.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: rollup==4.58.0 — 1 advisory(ies): CVE-2026-27606 (Rollup 4 has Arbitrary File Write via Path Traversal)

High
Category
Supply Chain
Confidence
94% confidence
Finding

rollup 4.58.0 is identified as vulnerable to arbitrary file write via path traversal, which is a serious issue when attacker-controlled paths can reach bundling or plugin workflows. Although this lockfile suggests dev-time exposure rather than production runtime exposure, arbitrary write in build infrastructure can still lead to code tampering or CI compromise.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==7.3.1 — 5 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-39363 (Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket) +2 more

High
Category
Supply Chain
Confidence
97% confidence
Finding

vite 7.3.1 is a real vulnerable dependency with multiple path traversal and arbitrary file read issues affecting the dev server. Because this skill concerns monetized API/tool creation and may plausibly be run by developers during local setup or demos, vulnerable dev-server components are more concerning than in a pure library package, even if not proven production-exposed here.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
92% confidence
Finding

ws 8.18.3 is a real vulnerable dependency with advisories for memory disclosure and memory exhaustion DoS. In this lockfile it is brought in by viem and tooling, so if the skill uses websocket-based blockchain/provider connections, malformed remote traffic could affect availability or leak process memory depending on how connections are exposed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The README recommends executing npx skills add gatex402/monetize-agent-skills --skill x402-creation without pinning a specific version or commit. This can lead users to install whatever version is current at execution time, increasing supply-chain risk if the registry package, resolver, or referenced skill source is compromised or changed unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill describes capabilities that inherently require network access and host-managed secrets, but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it harder for a host to constrain or review what the skill is permitted to do, especially given it can provision monetized endpoints and initiate withdrawals.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill exposes a withdrawal action that transfers earned USDC to a wallet, but the documentation does not require an explicit user confirmation, preview of destination/amount, or other approval gate before funds movement. In an agentic setting, this creates a real risk of unintended or manipulated financial actions, especially if an upstream prompt or compromised workflow invokes the tool automatically.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md
## Resources

- **Backend**: https://api.gatex402.dev (all provisioning, balance, and withdrawal requests)
- **OpenAPI spec**: https://api.gatex402.dev/openapi.json
- **Homepage**: https://gatex402.dev
- **Bazaar Discovery**: https://gatex402.dev/discover
- **AI Plugin**: https://api.gatex402.dev/.well-known/ai-plugin.json

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
## Resources

- **Backend**: https://api.gatex402.dev (all provisioning, balance, and withdrawal requests)
- **OpenAPI spec**: https://api.gatex402.dev/openapi.json
- **Homepage**: https://gatex402.dev
- **Bazaar Discovery**: https://gatex402.dev/discover
- **AI Plugin**: https://api.gatex402.dev/.well-known/ai-plugin.json

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill exposes a fund-transfer operation (withdraw_funds) but its description does not explicitly warn that invoking it will move earned USDC to a wallet. In an agent setting, insufficiently explicit descriptions increase the chance of unintended or socially engineered execution of irreversible financial actions, especially when users may not realize the tool has real asset-transfer side effects.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @vitest/mocker==4.0.18 — 1 advisory(ies): CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Low
Category
Supply Chain
Confidence
97% confidence
Finding

@vitest/mocker 4.0.18 is present as a dev dependency through Vitest, and the cited issue is a real supply-chain risk if the mocking/redirect functionality is exposed during test execution or developer workflows. In this lockfile context it is not directly runtime-exposed by the skill itself, but it still represents a genuine vulnerable component that could permit unintended file reads in local/CI environments.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: esbuild==0.27.3 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)

Low
Category
Supply Chain
Confidence
95% confidence
Finding

esbuild 0.27.3 is included as a dev dependency and has a known arbitrary file read issue tied to the development server on Windows. This is a real vulnerability in the dependency, though the danger is limited here because package-lock.json alone does not show the skill actively exposing an esbuild dev server in production.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json
"test": "vitest run"
    },
    "dependencies": {
        "dotenv": "^16.0.0",
        "viem": "^2.0.0",
        "zod": "^3.0.0"
    },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json
},
    "dependencies": {
        "dotenv": "^16.0.0",
        "viem": "^2.0.0",
        "zod": "^3.0.0"
    },
    "devDependencies": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json
"dependencies": {
        "dotenv": "^16.0.0",
        "viem": "^2.0.0",
        "zod": "^3.0.0"
    },
    "devDependencies": {
        "@types/node": "^25.3.0",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 17)May include surrounding context.

json
"zod": "^3.0.0"
    },
    "devDependencies": {
        "@types/node": "^25.3.0",
        "typescript": "^5.0.0",
        "vitest": "^4.0.18"
    }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 18)May include surrounding context.

json
},
    "devDependencies": {
        "@types/node": "^25.3.0",
        "typescript": "^5.0.0",
        "vitest": "^4.0.18"
    }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 19)May include surrounding context.

json
"devDependencies": {
        "@types/node": "^25.3.0",
        "typescript": "^5.0.0",
        "vitest": "^4.0.18"
    }
}

Static analysis

No suspicious patterns detected.