SkillzMarket

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:06 AM UTC
• Version: 1.0.5

Overview

This appears to be a legitimate paid Skillz Market client, but it can spend USDC from a wallet key and can send paid requests to arbitrary endpoints without built-in limits or confirmation.

Install only if you intentionally want an agent-accessible tool that can spend USDC from a configured wallet. Use a dedicated low-balance wallet, avoid `direct` unless you fully trust the endpoint, review destination and expected price before paid calls, and do not include secrets or sensitive data in request JSON.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares runtime requirements for environment variables and uses network-capable commands, but it does not declare explicit permissions to make those capabilities visible to users and policy engines. This reduces transparency and can cause users to invoke a skill that accesses secrets and external services, including payment endpoints, without clear permission gating.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose focuses on the Skillz Market ecosystem, but the exposed `direct <url> <json>` command allows calls to arbitrary x402-enabled URLs. That materially expands the trust boundary from a marketplace integration to a generic paid HTTP caller, increasing the risk of SSRF-like misuse, unexpected data exfiltration to third parties, and unreviewed cryptocurrency spending.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The CLI's stated purpose is to search and call skills from Skillz Market, but it also exposes a direct mode that can send paid requests to any arbitrary URL. In a tool wired to an on-chain payment signer, this materially expands the trust boundary: an attacker or confused user can route paid calls to unvetted endpoints outside the marketplace's review and policy controls.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The direct command authorizes arbitrary external paid requests using the configured private key, which is not justified by the skill's declared marketplace-only function. Because payment handling is automatically wrapped around fetch, this can be abused to trigger unintended cryptocurrency payments to attacker-controlled services or infrastructure masquerading as payable endpoints.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill advertises automatic USDC/x402 payments but does not prominently warn that using the call functionality can spend real funds. In this context, hidden or understated financial side effects are dangerous because users may treat the skill as a normal API/search integration and unknowingly authorize repeated paid requests.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation instructs users to store a wallet private key in config or an environment variable without emphasizing that this is a highly sensitive credential controlling spendable funds. If mishandled, exposed through logs, inherited processes, or weak local permissions, the key can be stolen and used to drain the wallet or make unauthorized payments.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The direct command forwards arbitrary user-provided input to any supplied URL with no meaningful warning or consent flow, creating a data exfiltration risk. Users may reasonably believe they are interacting within the Skillz Market ecosystem, while sensitive prompts or JSON payloads are actually transmitted to an external endpoint outside marketplace controls.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "Skillz Market",
  "license": "MIT",
  "dependencies": {
    "@x402/fetch": "^2.2.0",
    "@x402/evm": "^2.2.0",
    "viem": "^2.0.0",
    "tsx": "^4.21.0"

• Confidence: 91% confidence
• Finding: "@x402/fetch": "^2.2.0"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "MIT",
  "dependencies": {
    "@x402/fetch": "^2.2.0",
    "@x402/evm": "^2.2.0",
    "viem": "^2.0.0",
    "tsx": "^4.21.0"
  },

• Confidence: 91% confidence
• Finding: "@x402/evm": "^2.2.0"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "@x402/fetch": "^2.2.0",
    "@x402/evm": "^2.2.0",
    "viem": "^2.0.0",
    "tsx": "^4.21.0"
  },
  "devDependencies": {

• Confidence: 87% confidence
• Finding: "viem": "^2.0.0"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"@x402/fetch": "^2.2.0",
    "@x402/evm": "^2.2.0",
    "viem": "^2.0.0",
    "tsx": "^4.21.0"
  },
  "devDependencies": {
    "@types/node": "^20.0.0"

• Confidence: 79% confidence
• Finding: "tsx": "^4.21.0"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"tsx": "^4.21.0"
  },
  "devDependencies": {
    "@types/node": "^20.0.0"
  }
}

• Confidence: 74% confidence
• Finding: "@types/node": "^20.0.0"

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: skillz-cli.ts:6