ClawHub
Back to skill

Security audit

x402 Compute

Security checks for vulnerabilities and agentic risk

Overview

The cloud features match the skill’s purpose, but its optional node setup immediately executes a remote installer without first pinning or verifying it.

For cloud-only use, skip the optional node installer. Before running a node, obtain and verify a pinned release and use an isolated environment. Use a dedicated low-balance wallet, explicit spending limits, and scoped API keys; review backup contents, renewal settings, and deletion targets.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (107)

Tainted flow: 'key' from os.getenv (line 222, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/agent_pod.py (reported line 229)May include surrounding context.

python
{"model": "agent-pod", "stream": False, "messages": [{"role": "user", "content": message}]},
        separators=(",", ":"),
    )
    resp = requests.post(
        f"{BASE_URL}/pods/{pod_id}/v1/chat/completions",
        data=body_json,
        headers={"Content-Type": "application/json", "Authorization": f"Bearer {key}"},

Tainted flow: 'headers' from os.environ.get (line 183, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/grid_embeddings.py (reported line 184)May include surrounding context.

python
def list_models(base_url: str, key: str | None) -> int:
    headers = {"X-API-Key": key} if key else {}
    response = requests.get(
        f"{base_url.rstrip('/')}/v1/models",
        params={"type": "embedding"},
        headers=headers,

Tainted flow: 'key' from os.environ.get (line 206, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/grid_embeddings.py (reported line 209)May include surrounding context.

python
key = api_key(args.api_key)
    if not key:
        raise InputError("Set COMPUTE_API_KEY or SGL_API_KEY, or pass --api-key. Use --dry-run without credentials.")
    response = requests.post(
        f"{args.base_url.rstrip('/')}/v1/embeddings",
        data=raw,
        headers={"Content-Type": "application/json", "X-API-Key": key},

Tainted flow: 'headers' from os.environ.get (line 111, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/grid_transcription.py (reported line 112)May include surrounding context.

python
def list_models(base_url: str, key: str | None) -> int:
    headers = {"X-API-Key": key} if key else {}
    response = requests.get(
        f"{base_url.rstrip('/')}/v1/models",
        params={"type": "transcription"},
        headers=headers,

Tainted flow: 'params' from os.getenv (line 139, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/solana_signing.py (reported line 97)May include surrounding context.

python
def _rpc_call(method: str, params: list[Any]) -> Dict[str, Any]:
    response = requests.post(
        RPC_URL,
        json={"jsonrpc": "2.0", "id": 1, "method": method, "params": params},
        timeout=30,

Tainted flow: 'BASE_URL' from os.getenv (line 42, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/train_x402.py (reported line 48)May include surrounding context.

python
def catalog() -> dict:
    r = requests.get(f"{BASE_URL}/training/x402/catalog", timeout=30, allow_redirects=False)
    if r.status_code != 200:
        return {"error": f"catalog returned {r.status_code}", "response": r.text[:500]}
    return r.json()

Tainted flow: 'BASE_URL' from os.getenv (line 42, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/train_x402.py (reported line 174)May include surrounding context.

python
# was consumed by the quote.
    for n in range(attempts):
        try:
            return requests.post(f"{BASE_URL}/training/x402/runs", json=body,
                                 headers={"X-Payment": x_payment}, timeout=180, allow_redirects=False)
        except requests.RequestException:
            time.sleep(5 * (n + 1))

Tainted flow: 'BASE_URL' from os.getenv (line 42, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/train_x402.py (reported line 205)May include surrounding context.

python
chain="solana" if network == "solana" else "base")
    except Exception as exc:
        return {"error": f"Failed to sign the quote request: {exc}"}
    q = requests.post(f"{BASE_URL}/training/x402/runs", data=body_json,
                      headers={"Content-Type": "application/json", **auth_headers}, timeout=60, allow_redirects=False)
    if q.status_code != 402:
        return {"error": f"expected a 402 quote, got {q.status_code}", "response": q.text[:800]}

Tainted flow: 'BASE_URL' from os.getenv (line 42, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/train_x402.py (reported line 356)May include surrounding context.

python
def status(quote_id: str, claim_token: str) -> dict:
    r = requests.get(
        f"{BASE_URL}/training/x402/orders/{quote_id}",
        headers={"Authorization": f"Bearer {claim_token}"},
        timeout=30,

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
Managed models or the confidential **encrypted grid**. Failed jobs refund. See `references/datasets.md`.

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

md
| `POST /datasets/x402/synth` (402 → pay → poll) or the MCP dataset tools | **`references/datasets.md`** |

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md
on.py` / `extend_instance.py` / `resize_instance.py` / `destroy_instance.py` | `references/api-reference.md` |

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.

md
| "run inference on the grid", "confidential/TEE OpenAI-compatible inference" | curl / any OpenAI SDK → `grid.x402compute.cc` | `references/api-reference.md` |

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 875)May include surrounding context.

md
- [references/api-reference.md](references/api-reference.md)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 537)May include surrounding context.

md
Control API: `POST /compute/provision` (add `model_id`+`mode`; base fields `plan`,`region`,`os_id`),
`GET /compute/instances`, `GET /compute/instances/:id`, `POST /compute/instances/:id/extend`,
`POST /compute/instances/:id/resize`, `POST /compute/instances/:id/password`,
`DELETE /compute/instances/:id`, `POST /compute/credits/topup`. Full detail + the end-to-end agent
deploy example → **`references/ai-machines.md`**.

---

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 570)May include surrounding context.

md
# Top up credits in the dashboard: Settings → Credits (cloud.x402compute.cc).

# 2) Check what's being served + whether the grid has capacity
curl https://grid.x402compute.cc/v1/models -H "X-API-Key: $COMPUTE_API_KEY"
curl https://grid.x402compute.cc/grid/capacity            # active_nodes, models, at_capacity

# 3) OpenAI-compatible chat (billed to credits)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 782)May include surrounding context.

POST /pods//wallet/send {chain, to, token, amount, idempotency_key}

POST /pods//wallet/x402/pay {url, method?, headers?, body?, max_amount_usd?}

text
`GET /pods/<id>` returns a masked `credentials` block — the preinstalled skills' pod-scoped Compute key + Studio PAT (for the marketplace / MCP) and its daily cap. Manage it with `POST /pods/<id>/credentials` (`{"action":"enable"|"regenerate"|"set-cap"|"byok", ...}`) or `DELETE /pods/<id>/credentials` to revoke. Delegated creds, native Singularity MCP, wallet sending, and memory are **feature-gated** and may be dark until launch.

### Extend / destroy
A pod is a compute order, so use the **Machines endpoints with the pod id as the instance id**:

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/agent-pods.md (reported line 232)May include surrounding context.

text
`GET /pods/<id>` returns a masked `credentials` block (the preinstalled skills' pod-scoped Compute
key + Studio PAT and its daily cap). Manage with `POST /pods/<id>/credentials`
(`{"action":"enable"|"regenerate"|"set-cap"|"byok", ...}`) or `DELETE /pods/<id>/credentials` to
revoke. Delegated creds, native Singularity MCP, wallet sending, and memory are feature-gated and
may be dark until launch.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 811)May include surrounding context.

-d '{"model":"agent-pod","stream":false,"messages":[{"role":"user","content":"Hello"}]}'

text
Keys are bound to the pod, carry a daily request cap (default 1000/day → `429` over-cap), and are
revocable (`DELETE /pods/<id>/api-keys/<keyId>`). Full body fields, response shapes, and error codes
→ **`references/agent-pods.md`**. Scripted end-to-end: `scripts/agent_pod.py` (`deploy` → `create-key`
→ `chat`).

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/agent-pods.md (reported line 24)May include surrounding context.

md
| Surface | Endpoints | Auth |
|---------|-----------|------|
| **Owner** (manage the pod) | `POST /pods`, `GET/PATCH /pods/{id}`, `POST /pods/{id}/actions`, `GET/POST/DELETE /pods/{id}/api-keys*`, wallet, credentials | **Compute auth** — `X-API-Key: x402c_…`, a signed compute session, or an `X-Auth-*` wallet signature. Required even when paying with x402, because a pod is owned by your wallet. |
| **Adapter** (talk to the agent) | `GET /pods/{id}/v1/models`, `POST /pods/{id}/v1/chat/completions` | **`Authorization: Bearer sk-sglpod-int-…`** — a pod-scoped integration key you mint via `POST /pods/{id}/api-keys`. NOT compute auth. |

The catalog (`GET /pods/catalog`) is public (no auth).

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/agent-pods.md (reported line 269)May include surrounding context.

  • The raw key (sk-sglpod-int-…) is returned ONCE — store it. Only its SHA-256 hash is kept.
  • The key is bound to this pod; using it against a different pod fails as invalid_key.
  • Each key has a daily request cap (default 1000/day, rolling 24h window); over-cap → 429.
  • List: GET /pods/{id}/api-keys (masked). Revoke: DELETE /pods/{id}/api-keys/{keyId}.

4b. Call the adapter — Authorization: Bearer sk-sglpod-int-…

bash

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/agent-vault.md (reported line 50)May include surrounding context.

agentvault list # agents + snapshot counts agentvault restore # pick snapshot -> passphrase -> safe unpack agentvault restore --dest ~/x # restore into a specific directory agentvault passphrase set # store passphrase in the OS keychain agentvault daemon install --frequency weekly # automatic backups

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 302)May include surrounding context.

md
---

### DELETE /compute/instances/:id

Destroy an instance immediately.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 449)May include surrounding context.

md
---

### DELETE /compute/api-keys/:id

Revoke an API key (signature auth required).

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The installation command downloads a mutable remote script and immediately executes it without independently verifying its integrity or provenance. Compromise of the distribution endpoint could execute arbitrary code with the invoking user's permissions; agent-runnable installation on a node operator's machine increases exposure of local credentials and wallet-related files, although no malicious payload is shown.

Content

Scanner excerpt · references/node-operator.md (reported line 52)May include surrounding context.

bash
# 1. Install the sgl node CLI (Singularity-Layer/sgl-network-node release)
curl -sSf https://grid.x402compute.cc/install.sh | sh

# 2. Local inference runtime
brew install llama.cpp            # macOS; see repo README for Linux

Static analysis

No suspicious patterns detected.