T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:21
- Finding
- Automatic Cryptocurrency Payment and Permit Signing Without Explicit User Confirmation## Vulnerability Details **File Location**: `SKILL.md`, lines 21-26 **Vulnerability Type**: Unrestricted automatic payment and signing workflow **Risk Level**: High ### Vulnerable Code ```markdown 1. **Request Resource**: When triggered, follow the instructions provided by the `x402-payment-tron` skill to fetch the protected resource. **Use Tron Nile by default**: - **Tron Nile (Default)**: `https://x402-tron-demo.aibank.io/protected-nile` - **Tron Shasta**: `https://x402-tron-demo.aibank.io/protected-shasta` - **Tron Mainnet**: `https://x402-tron-demo.aibank.io/protected-mainnet` 2. **Handle Payment**: Perform the payment and resource acquisition automatically as guided by the protocol (handling 402 Payment Required, signing permits, etc.). 3. **Display & Cleanup**: Once the image is retrieved, present it to the user. Immediately delete the local temporary file after the image has been displayed. ``` ### Technical Analysis The skill directs the agent to execute a cryptocurrency payment automatically, including signing permits, after receiving payment requirements through the x402 protocol. This operation is available for TRON mainnet as well as test networks. The workflow does not require an explicit confirmation immediately before signing or payment. It also defines no maximum payment amount, permitted token, approved recipient, expected chain identifier, fee ceiling, or restriction on the scope of signed data. Consequently, the transaction parameters supplied through the external payment endpoint or the referenced `x402-payment-tron` skill may become the effective authorization request without sufficient validation. The security-critical payment implementation is delegated to another skill that was not included in the audited project. Its validation and signing behavior therefore could not be verified. This finding does not establish that the listed endpoints or the referenced skill are malicious; it id ...[truncated 1521 chars]
- Remediation
- ## Remediation Suggestions 1. Default exclusively to a test network and require a separate, explicit opt-in before allowing mainnet operations. 2. Require informed user confirmation immediately before every signature or payment. Present the network, chain identifier, token contract, token symbol, amount, recipient, estimated fees, expiration, and complete authorization scope. 3. Enforce hard-coded allowlists for supported chain identifiers, payment tokens, verified contracts, recipients, and endpoint origins. 4. Apply a conservative payment ceiling and reject zero-decimal ambiguities, malformed amounts, unexpected assets, excessive fees, and values above the configured limit. 5. Parse and independently validate HTTP 402 payment requirements rather than treating remote protocol fields as trusted instructions. 6. Restrict signatures to the exact payment required for the current request. Reject unlimited allowances, broad permit scopes, unexpected contract calls, arbitrary typed data, and network mismatches. 7. Pin the version and integrity of the `x402-payment-tron` dependency and audit its endpoint validation, transaction construction, signing, and error-handling logic before use. 8. Provide a dry-run transaction preview and retain a non-sensitive audit record containing the confirmed transaction parameters and resulting transaction identifier. 9. Fail closed when any network, recipient, asset, amount, signature payload, or payment response differs from the expected policy.