T09 · Insecure Skill Coding Practices
- Location
SKILL.md:17- Finding
Automatic Cryptocurrency Payments Lack Explicit Safety Controls
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:17, 38-47
Vulnerability Type: Unbounded automatic cryptocurrency payment authorization
Risk Level: MediumComplete Relevant Snippet:
markdown It is **x402-native**: agents detect the 402 response, pay a tiny USDC amount instantly via their wallet, and continue. No keys, no subscriptions. ## Setup & Prerequisites 1. Make sure the official x402 skill is installed (it handles automatic payment on 402 responses). 2. No extra configuration needed — the skill discovers the base URL and x402 flow automatically. ## Pricing (what agents will pay) - /search, /filter, /rank: ~$0.003 each - /product-details: ~$0.010 - /best (one-shot): ~$0.020 Prices are micropayments in USDC on Base Sepolia (or mainnet when enabled).Technical Analysis
The Skill directs an agent to use a separate x402 component that automatically pays USDC whenever the remote service returns an HTTP 402 payment request. The documented prices are approximate and informational; the instructions do not require the agent or payment component to enforce them.
No mandatory safeguards are specified for:
- Transaction-specific user approval
- Maximum payment amount per request
- Aggregate spending per session
- Validation of the payment recipient
- Pinning of the chain and token contract
- Rejection of payment demands that exceed the documented price
- Prevention of automatic transition from testnet to mainnet
- Retry limits for paid requests
Consequently, payment authorization depends on payment parameters supplied through a remote response. If the service, payment metadata, DNS resolution, or companion payment component is compromised or misconfigured, an agent following these instructions could authorize an unexpected payment. Even correctly priced calls can accumulate charges through repeated requests.
Attack Path
- A user asks the agent to search for, rank, f ...[truncated 1355 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit, transaction-specific user confirmation before every mainnet payment. The confirmation should show the chain, token, recipient, exact amount, endpoint, and cumulative session cost.
- Pin the permitted chain ID, USDC token contract, API origin, and payment recipient or recipient allowlist. Reject any mismatch.
- Define hard maximum prices for every endpoint and reject payment demands above those limits rather than relying on approximate documentation.
- Enforce per-transaction, per-workflow, per-session, and daily spending limits.
- Default to Base Sepolia and require an explicit configuration change and renewed user consent before enabling mainnet.
- Disable automatic payment retries. Require fresh authorization if a paid request fails or another HTTP 402 response is received.
- Estimate and disclose the maximum workflow cost before initiating multi-stage flows such as
/search→/filter→/rank→/product-details. - Record payment decisions and receipts in an audit log without exposing wallet secrets.
- Update the Skill instructions to state that HTTP 402 metadata is untrusted input and must be validated before signing or submitting a transaction.