Security audit

Haven Media (x402)

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent paid media-generation integration, but it should be reviewed carefully because it can spend real USDC through a local wallet without per-call human approval and recommends an unpinned MCP package.

Install only if you are comfortable sending media prompts or uploaded images to Haven and letting an agent spend USDC from a local wallet. Keep mainnet spending disabled until you intentionally fund the wallet, keep low spend caps, prefer a pinned and reviewed MCP package version over @latest, and avoid submitting secrets, regulated data, or private media unless the provider is approved for that use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: haven-media-x402 description: Generate music, images, and video (silent or with a synchronized soundtrack) by paying per call in USDC via x402 — no account or API key. Use when the agent needs to create media it cannot produce natively. compatibility: Needs network access to api.havenagent.ai and a USDC wallet on Base — either the @havenagent/mcp server (Node.js 20+), which holds one locally, or your own x402 v2 client. metadata: homepage: https://api.havenagent.ai/x402/api/v1/catalog

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: This skill is explicitly designed to transmit prompts, input media, job metadata, and payment-related requests to an external service at api.havenagent.ai. That external transmission is inherent to the skill, but it still creates a real data exposure boundary: sensitive prompts or media could be sent off-host, logged remotely, or retained by the provider.
Content: Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.
md
description: Generate music, images, and video (silent or with a synchronized soundtrack) by paying per call in USDC via x402 — no account or API key. Use when the agent needs to create media it cannot produce natively. compatibility: Needs network access to api.havenagent.ai and a USDC wallet on Base — either the @havenagent/mcp server (Node.js 20+), which holds one locally, or your own x402 v2 client. metadata: homepage: https://api.havenagent.ai/x402/api/v1/catalog payment: x402 network: base asset: USDC

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs users to execute an unpinned package via npx -y @havenagent/mcp@latest, which fetches and runs whatever code is current at install time. If the package is compromised, typo-squatted, or a malicious update is published, the agent environment could execute attacker-controlled code with access to network, local files, and potentially a funded wallet.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/use-terms.md (reported line 16)May include surrounding context.
md
The full, controlling text is at `terms.url`. The summary includes, among others: no unlawful use, nothing involving minors, no impersonation or deepfakes of real people without consent, **no using the output to train, improve, or fine-tune any model**, and — the two that bind you onward: - **Disclose that the output is machine-generated wherever you publish it.**

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/x402-http.md (reported line 7)May include surrounding context.
md
If your agent can run the Haven MCP server instead, use it: it does all of this for you. Rules, limits, and prices are in `SKILL.md`. 1. **Discover**: `GET https://api.havenagent.ai/x402/api/v1/catalog` (free) — returns every endpoint, price, request schema, and limits. 2. **Request**: `POST` the endpoint with a JSON body. With no payment you get **HTTP 402** and a machine-readable price quote.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/x402-http.md (reported line 62)May include surrounding context.
md
If your agent can run the Haven MCP server instead, use it: it does all of this for you. Rules, limits, and prices are in `SKILL.md`. 1. **Discover**: `GET https://api.havenagent.ai/x402/api/v1/catalog` (free) — returns every endpoint, price, request schema, and limits. 2. **Request**: `POST` the endpoint with a JSON body. With no payment you get **HTTP 402** and a machine-readable price quote.

Static analysis

No suspicious patterns detected.