x402-payment-tron

• Analyzed: May 12, 2026, 3:21 AM
• Findings: 1
• Version: 0.0.4
• Hash: e5eae398f44bf2fb398575947643651f49a69cd1a3b6575a226855fdd69182d7
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed for cryptocurrency payments on TRON, which inherently involves high financial risk. The most significant indicator is the explicit documentation in `SKILL.md` and the underlying implementation in `src/index.ts` (via `@open-aibank/x402-tron`) of an 'infinite approval' (MAX_UINT256) for USDT tokens if allowance is insufficient. While this is a stated feature to minimize future transactions, it grants unlimited spending power to a smart contract, posing a substantial financial risk to the user. The skill also accesses private keys from environment variables and specific configuration files (`~/.mcporter/mcporter.json`, `x402-config.json`, `~/.x402-config.json`) for its operation, which is necessary for its function but represents a sensitive capability. However, `SKILL.md` and `src/index.ts` include strong anti-prompt-injection measures, explicitly instructing the agent not to output, search for, or leak private keys, and sanitizing error messages, which mitigates some risks.