T09 · Insecure Skill Coding Practices
Error
- Location
scripts/x402-generate.mjs:48- Finding
Automatic x402 Payment Signing Without Local Payment-Term Validation
- Content
View full analysis
80 ? '...' : ''}"`); console.log(` Model: ${model}`); console.log(` Duration: ${duration}s`); if (agentId) console.log(` Agent: ${agentId}`); console.log(); const res = await fetchWithPayment(`${API_BASE}/generation/create`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ prompt, videoModel: model, duration, ...(agentId && { agentId }) }), }); ``` ### Technical Analysis The script constructs a signer from `EVM_PRIVATE_KEY` and passes it directly to an x402 payment wrapper. When the ClawdVine API returns an HTTP `402 Payment Required` response, the wrapper can process the remotely supplied payment requirements, sign the corresponding authorization, and retry the request automatically. The script does not independently enforce any of the following before signing: - A maximum amount previously approved by the user - Base mainnet as the expected chain - The expected USDC token contract - The expected payment receiver - The expected resource URL - Payment expiration or validity limits - Equality between the signed terms and a previously displayed pre-flight quote This conflicts with the pre-flight ...[truncated 2111 chars]- Remediation
View remediation