x402 Compute

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:38 PM UTC
• Version: 1.26.0

Overview

The skill is coherent for managing paid compute and agent hosting, but it includes high-impact wallet, credential, infrastructure, and persistent-service workflows with supply-chain and secret-handling concerns.

Review this before installing if you will let an agent operate funded wallets, paid compute, hosted pods, processors, or backups. Use dedicated low-balance wallets, narrowly scoped and revocable API keys, avoid putting real secrets in command arguments, inspect or replace the curl-to-shell installer, pin dependencies where possible, and treat destroy, credential, daemon, and service-install actions as actions requiring explicit approval.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:533
• Finding: Mutable Remote Installer Is Piped Directly into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:533`; duplicated in `references/node-operator.md:49` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -sSf https://grid.x402compute.cc/install.sh | sh ``` The downloaded software is subsequently configured as a persistent operating-system service: ```bash sgl service install \ --model-path ~/models/Llama-3.2-3B-Instruct-Q4_K_M.gguf \ --model-name llama-3.2-3b \ --resource-percent 50 ``` ### Technical Analysis The instructions retrieve a mutable script from an external server and execute it immediately without: - Pinning a release version or immutable artifact. - Verifying a cryptographic checksum or signature. - Saving the script for inspection. - Constraining it with a sandbox or reduced-privilege account. - Documenting the commands and files the installer modifies. Consequently, the effective code executed by the Skill can change after this repository has been reviewed. HTTPS protects transport integrity under ordinary conditions but does not protect against compromise of the service, CDN, DNS or TLS infrastructure, deployment pipeline, or publisher account. The later `sgl service install` command intentionally creates a background service that survives logout and reboot. Running a persistent inference node is within the declared provider functionality, but persistence significantly increases the consequences of an unsafe installer. ### Attack Path 1. An attacker compromises `grid.x402compute.cc`, its deployment pipeline, or the hosted `install.sh`. 2. The attacker changes the response to include arbitrary shell commands. 3. A user or Agent follows the documented `curl | sh` instruction. 4. The shell immediately executes the modified response with the invoking user's privileges. 5. The payload steals accessible files or credentials, modifies local configuration, or replaces the `sgl` binary. 6. The subsequent ...[truncated 691 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | sh` instructions. 2. Publish versioned, immutable release artifacts through the documented source repository. 3. Download the artifact to disk before execution. 4. Publish and verify a pinned SHA-256 digest and a release signature from a separately trusted signing key. 5. Display or document the installer contents, installed paths, service definition, network endpoints, and requested privileges. 6. Run the node under a dedicated unprivileged service account with restrictive filesystem access. 7. Enable the documented sandbox by default and apply equivalent hardening on every supported operating system. 8. Require explicit confirmation before creating a persistent service and provide complete uninstall instructions. ]]>

T08 · Insecure Dependencies

Error

• Location: requirements.txt:1
• Finding: Executable and Python Dependencies Are Not Consistently Pinned<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-4`; `SKILL.md:209,274,318,725`; `references/agent-vault.md:41`; `references/processors.md:27` **Vulnerability Type**: Insecure software supply chain **Risk Level**: High ### Vulnerable Code The Python dependency manifest permits any later release above the stated minimum: ```text eth-account>=0.8.0 web3>=6.0.0 requests>=2.28.0 solders>=0.20.0 ``` The documentation also directs users to download or execute npm packages without exact versions: ```bash npx @singularity-layer/agentvault npx mppx https://compute.x402layer.cc/compute/provision npm i -g @singularity-layer/agentvault npm i -g @singularity-layer/cli ``` The Agent Vault package has particularly broad capabilities: ```bash agentvault backup --all agentvault backup --path <dir> --name <n> agentvault daemon install --frequency weekly ``` ### Technical Analysis Minimum-version Python constraints do not produce a reproducible dependency graph and do not authenticate package contents. A future direct or transitive dependency release can be selected during installation without a repository change. Unversioned `npx` invocations are more dangerous because they may fetch and immediately execute the current registry package. Global npm installation also exposes future users to whichever release is current at installation time. The potential privilege of these packages is substantial: - Wallet and signing libraries process private-key operations. - `mppx` participates in paid provisioning flows. - Agent Vault can read arbitrary user-selected directories, encrypt and upload their contents, restore files, and install a recurring daemon. - The processor CLI bundles and publishes local code. No evidence establishes that the current packages are malicious. The confirmed issue is that the reviewed Skill does not bind execution to the versions and artifacts that were audited. ### Attack Path 1. A package publisher account, npm/PyPI pack ...[truncated 1041 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace all minimum-version Python constraints with an exact, reviewed lock file. 2. Include hashes for direct and transitive Python dependencies and install with hash verification. 3. Pin every npm command to an exact version; do not use unversioned `npx`. 4. Prefer explicit installation followed by invocation of a locally verified executable. 5. Commit npm lockfiles where applicable and enforce package integrity metadata. 6. Verify package provenance, release signatures, publisher identity, and source-to-artifact reproducibility. 7. Isolate backup and wallet tooling in separate least-privilege environments. 8. Require explicit user confirmation before arbitrary-directory access or daemon installation. ]]>

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/ows_cli.py:57
• Finding: PATH-Based OWS Resolution Permits Signer-Tool Substitution<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ows_cli.py:57-74`; equivalent behavior in `scripts/wallet_signing.py:200-225` **Vulnerability Type**: Local signing-tool hijacking **Risk Level**: High ### Vulnerable Code ```python def build_ows_command(args: List[str]) -> List[str]: explicit_bin = os.getenv("OWS_BIN", "").strip() if explicit_bin: return [resolve_ows_bin(explicit_bin), *args] local_ows = shutil.which("ows") if local_ows: return [local_ows, *args] raise ValueError( "OWS binary not found. Install it with:\n" f" npm install -g {OWS_PINNED_PACKAGE}\n" "Then ensure `ows` is in your PATH, or set OWS_BIN to the full executable path.\n" "Avoid runtime npx downloads for wallet operations." ) def run_ows(args: List[str], timeout: int = 180) -> int: proc = subprocess.run(build_ows_command(args), text=True, capture_output=True, timeout=timeout) ``` ### Technical Analysis When `OWS_BIN` is explicitly configured, the code validates that it is an absolute path, resolves symlinks, confirms that it exists and is executable, and rejects world-writable files and parent directories. When `OWS_BIN` is absent, `shutil.which("ows")` resolves the executable through the caller-controlled `PATH`, but the resulting path bypasses those validation controls. A fake executable in an earlier PATH directory can therefore impersonate the wallet tool. The wrapper sends the selected executable wallet-listing, message-signing, and key-management arguments. Although private keys may remain inside the legitimate OWS implementation, a substituted tool executes arbitrary code and can return forged signer output. ### Attack Path 1. An attacker gains write access to a directory that precedes the legitimate OWS installation in `PATH`. 2. The attacker places an executable named `ows` in that directory. 3. The user runs an OWS-backed compute-authentication, signing, or key-management workfl ...[truncated 859 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require `OWS_BIN` to be an absolute, explicitly configured path for every wallet operation. 2. If PATH resolution remains supported, apply the same resolved-path, permission, ownership, and parent-directory validation used for explicit paths. 3. Reject executables located in user- or world-writable directories. 4. Pin and verify the expected executable hash or signed release. 5. Use a controlled minimal environment and PATH when invoking the subprocess. 6. Apply the fix consistently in both `ows_cli.py` and `wallet_signing.py`. 7. Document that signer execution must not rely on an ambient PATH in automated or privileged environments. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/get_one_time_password.py:49
• Finding: One-Time Root Password Is Persisted in a Predictable Plaintext File<![CDATA[ ## Vulnerability Details **File Location**: `scripts/get_one_time_password.py:49-59` **Vulnerability Type**: Plaintext sensitive-data storage and unsafe file creation **Risk Level**: Medium ### Vulnerable Code ```python if password: fname = f".compute_password_{instance_id}" with open(fname, "w", encoding="utf-8") as f: f.write(f"username={access.get('username', 'root')}\n") f.write(f"ip={access.get('ip_address', '')}\n") f.write(f"password={password}\n") import os, stat os.chmod(fname, stat.S_IRUSR | stat.S_IWUSR) print(f" Credentials saved to {fname} (mode 600)") ``` ### Technical Analysis The retrieved root password is automatically stored unencrypted in the current working directory using a predictable filename derived from the instance identifier. The code creates or truncates the file using the process's current umask and only changes it to mode `0600` after all credentials have been written. This produces a creation-time interval in which permissions can be broader than intended. The file is retained indefinitely and may be included in workspace synchronization, backups, support bundles, or source-control operations. The retrieval request itself is authenticated and sent only to the declared compute service. The vulnerability concerns local handling after successful retrieval. ### Attack Path 1. An authenticated user retrieves the one-time password. 2. The script creates `.compute_password_<instance_id>` in the current directory. 3. The plaintext credential remains on disk after the command completes. 4. A local process, workspace backup, synchronization tool, accidental commit, or artifact collector obtains the file. 5. The attacker uses the stored username, IP address, and password to authenticate to the instance. A local attacker may also attempt predictable-path manipulation in a directory they can influence, because creation does not use exclusive or no-follow semantics. ### Impact As ...[truncated 478 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not automatically persist the password. 2. Prefer an interactive, one-time display that is not included in normal structured or Agent logs. 3. Offer OS keychain or secret-manager storage. 4. If file output is explicitly requested, require a user-selected path and create it atomically with mode `0600`. 5. Use `os.open` with `O_CREAT | O_EXCL` and appropriate no-follow protections where supported. 6. Refuse to overwrite existing files or follow symbolic links. 7. Warn users not to place the file in repositories, synchronized directories, or ordinary backups. 8. Provide a clear deletion workflow and recommend immediate migration to SSH public-key authentication. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/agent_pod.py:229
• Finding: Hosted-Service Secrets Are Accepted Through Process Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/agent_pod.py:229-236`; examples at `scripts/agent_pod.py:21-24` and `SKILL.md:216-218` **Vulnerability Type**: Sensitive information exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```python p_dep.add_argument("--model", help="Managed model override (must be in tier list) or byok model id") p_dep.add_argument("--telegram", help="Telegram bot token") p_dep.add_argument("--discord", help="Discord bot token") p_dep.add_argument("--llm-base-url", help="BYOK: OpenAI-compatible base URL") p_dep.add_argument("--llm-api-key", help="BYOK: your LLM API key") p_dep.add_argument("--llm-api", choices=["openai-completions", "openai-responses", "anthropic-messages", "google-generative"], help="BYOK: LLM API shape (default openai-completions)") ``` The documented usage encourages direct secret placement in argv: ```bash python agent_pod.py deploy --ai-mode managed --tier pro --plan <plan_id> \ --prepaid-hours 720 --telegram <bot_token> --use-credits python agent_pod.py deploy --ai-mode byok --plan <plan_id> --prepaid-hours 720 \ --llm-base-url https://openrouter.ai/api/v1 --llm-api-key <key> \ --model openai/gpt-4o-mini --use-credits ``` ### Technical Analysis Telegram, Discord, and LLM credentials are accepted directly as command-line values. Process arguments can be exposed through: - Shell history. - Process inspection facilities. - Agent command transcripts. - CI/CD logs and telemetry. - Terminal session recording. - Error-reporting and command-audit systems. Sending these credentials to `compute.x402layer.cc` is explicitly disclosed and is required to configure a hosted pod. The vulnerability is the local secret-delivery mechanism, not the declared network transfer. ### Attack Path 1. A user follows the documented deployment command and includes a real bot or LLM token. 2. The shell records the command in history, or a process/logging syste ...[truncated 829 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer protected environment variables, OS keychain references, or secret-manager identifiers. 2. Add interactive `getpass` prompts for bot, LLM, and integration credentials. 3. Support reading secrets from a protected file descriptor or mode-`0600` file. 4. Remove real-secret argv patterns from documentation. 5. Deprecate raw secret command-line flags or require an explicit warning acknowledgment. 6. Ensure errors and debug output redact authorization values and credential-bearing request fields. 7. Recommend narrowly scoped, revocable credentials with spending and request caps. 8. Document immediate token rotation procedures for suspected command-history exposure. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/create_api_key.py:52
• Finding: Newly Issued API Credentials Are Printed to Standard Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/create_api_key.py:52-57`; equivalent pod-key output at `scripts/agent_pod.py:293-296` **Vulnerability Type**: Sensitive information exposure through logs and standard output **Risk Level**: Low ### Vulnerable Code ```python print("API Key created:") print(f" ID: {result.get('id')}") print(f" Label: {result.get('label') or 'N/A'}") print(f" Key: {result.get('api_key')}") print(f" Created: {result.get('created_at')}") print("Store this key securely; it will not be shown again.") ``` The pod workflow behaves similarly: ```python if result.get("key"): print("✅ Integration key created (shown ONCE — store it securely):") print(f" Key: {result['key']}") print(f" Base URL: {result.get('base_url')}") ``` ### Technical Analysis The service returns these credentials only once, but the scripts emit them to standard output. In an Agent, CI, automation, or terminal-recording environment, stdout is frequently retained beyond the intended display period. The warning to store the key securely does not prevent it from entering logs. Because the full secret is included in ordinary output, generic log collectors cannot distinguish it from non-sensitive status information. ### Attack Path 1. A user or Agent creates a compute or pod integration key. 2. The script prints the complete key to stdout. 3. An Agent transcript, CI log, shell redirection, terminal recorder, or observability system retains the output. 4. An unauthorized reader obtains the stored log. 5. The reader reuses the credential against the compute-management API or pod adapter. ### Impact Assessment A leaked compute API key may permit authenticated management operations and consumption of prepaid credits within the key's server-side permissions. A leaked pod integration key may permit calls to that pod's OpenAI-compatible adapter and expose or influence Agent interactions. Server-side caps and revocation redu ...[truncated 90 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not include full credentials in normal stdout or JSON output. 2. Store newly issued credentials directly in an OS keychain or approved secret manager. 3. Alternatively, write to a user-selected file created atomically with mode `0600`. 4. Display a secret only when stdout is an interactive TTY and after explicit confirmation. 5. Redact all but a short prefix and suffix in logs and status output. 6. Mark secret-bearing response fields for automatic redaction in Agent and CI integrations. 7. Provide immediate revocation and rotation instructions. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (82)

Tainted flow: 'key' from os.getenv (line 194, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

{"model": "agent-pod", "stream": False, "messages": [{"role": "user", "content": message}]},
        separators=(",", ":"),
    )
    resp = requests.post(
        f"{BASE_URL}/pods/{pod_id}/v1/chat/completions",
        data=body_json,
        headers={"Content-Type": "application/json", "Authorization": f"Bearer {key}"},

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill description understates that it performs direct blockchain signing and on-chain interaction, including Solana transaction-related operations. In a system routing user requests by description, this mismatch can cause an agent to select a skill with materially more sensitive capabilities than the user or orchestrator expects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description understates that it performs direct blockchain signing and on-chain interaction, including Solana transaction-related operations. In a system routing user requests by description, this mismatch can cause an agent to select a skill with materially more sensitive capabilities than the user or orchestrator expects.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

Control API: `POST /compute/provision` (add `model_id`+`mode`; base fields `plan`,`region`,`os_id`),
`GET /compute/instances`, `GET /compute/instances/:id`, `POST /compute/instances/:id/extend`,
`POST /compute/instances/:id/resize`, `POST /compute/instances/:id/password`,
`DELETE /compute/instances/:id`, `POST /compute/credits/topup`. Full detail + the end-to-end agent
deploy example → **`references/ai-machines.md`**.

---

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Script Fetching

High

• Category: Supply Chain

Content

# Top up credits in the dashboard: Settings → Credits (cloud.x402compute.cc).

# 2) Check what's being served + whether the grid has capacity
curl https://grid.x402compute.cc/v1/models -H "X-API-Key: $COMPUTE_API_KEY"
curl https://grid.x402compute.cc/grid/capacity            # active_nodes, models, at_capacity

# 3) OpenAI-compatible chat (billed to credits)

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#   POST /pods/<id>/wallet/send      {chain, to, token, amount, idempotency_key}
#   POST /pods/<id>/wallet/x402/pay  {url, method?, headers?, body?, max_amount_usd?}
```
`GET /pods/<id>` returns a masked `credentials` block — the preinstalled skills' pod-scoped Compute key + Studio PAT (for the marketplace / MCP) and its daily cap. Manage it with `POST /pods/<id>/credentials` (`{"action":"enable"|"regenerate"|"set-cap"|"byok", ...}`) or `DELETE /pods/<id>/credentials` to revoke. Delegated creds, native Singularity MCP, wallet sending, and memory are **feature-gated** and may be dark until launch.

### Extend / destroy
A pod is a compute order, so use the **Machines endpoints with the pod id as the instance id**:

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

-d '{"model":"agent-pod","stream":false,"messages":[{"role":"user","content":"Hello"}]}'
```
Keys are bound to the pod, carry a daily request cap (default 1000/day → `429` over-cap), and are
revocable (`DELETE /pods/<id>/api-keys/<keyId>`). Full body fields, response shapes, and error codes
→ **`references/agent-pods.md`**. Scripted end-to-end: `scripts/agent_pod.py` (`deploy` → `create-key`
→ `chat`).

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Surface | Endpoints | Auth |
|---------|-----------|------|
| **Owner** (manage the pod) | `POST /pods`, `GET/PATCH /pods/{id}`, `POST /pods/{id}/actions`, `GET/POST/DELETE /pods/{id}/api-keys*`, wallet, credentials | **Compute auth** — `X-API-Key: x402c_…`, a signed compute session, or an `X-Auth-*` wallet signature. Required even when paying with x402, because a pod is owned by your wallet. |
| **Adapter** (talk to the agent) | `GET /pods/{id}/v1/models`, `POST /pods/{id}/v1/chat/completions` | **`Authorization: Bearer sk-sglpod-int-…`** — a pod-scoped integration key you mint via `POST /pods/{id}/api-keys`. NOT compute auth. |

The catalog (`GET /pods/catalog`) is public (no auth).

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```
`GET /pods/<id>` returns a masked `credentials` block (the preinstalled skills' pod-scoped Compute
key + Studio PAT and its daily cap). Manage with `POST /pods/<id>/credentials`
(`{"action":"enable"|"regenerate"|"set-cap"|"byok", ...}`) or `DELETE /pods/<id>/credentials` to
revoke. Delegated creds, native Singularity MCP, wallet sending, and memory are feature-gated and
may be dark until launch.

• Confidence: 87% confidence
• Finding: The credentials management section exposes powerful actions such as enable, regenerate, BYOK, and DELETE revoke for preinstalled pod-scoped credentials, but it does not define strict operator safety constraints or confirmation requirements. In an agent ecosystem, ambiguous credential-management operations can be abused through prompt/tool invocation to revoke working credentials, swap in attacker-controlled BYOK keys, or change caps, impacting integrity and potentially billing or data access.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- The **raw key (`sk-sglpod-int-…`) is returned ONCE** — store it. Only its SHA-256 hash is kept.
- The key is **bound to this pod**; using it against a different pod fails as `invalid_key`.
- Each key has a **daily request cap** (default 1000/day, rolling 24h window); over-cap → `429`.
- List: `GET /pods/{id}/api-keys` (masked). Revoke: `DELETE /pods/{id}/api-keys/{keyId}`.

### 4b. Call the adapter — `Authorization: Bearer sk-sglpod-int-…`
```bash

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High

• Category: Privilege Escalation

Content

agentvault list               # agents + snapshot counts
agentvault restore            # pick snapshot -> passphrase -> safe unpack
agentvault restore --dest ~/x # restore into a specific directory
agentvault passphrase set     # store passphrase in the OS keychain
agentvault daemon install --frequency weekly   # automatic backups
```

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

---

### DELETE /compute/instances/:id

Destroy an instance immediately.

• Confidence: 87% confidence
• Finding: `DELETE /compute/instances/:id` is a destructive management action that can be dangerous in an agent skill because an attacker or confused workflow may coerce the tool into deleting the wrong resource by supplying or substituting an instance ID. The risk is elevated by the skill context: it is specifically designed for autonomous or semi-autonomous infrastructure management, where parameter misuse can directly cause outages and data loss.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

---

### DELETE /compute/api-keys/:id

Revoke an API key (signature auth required).

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# 1. Install the sgl node CLI (Singularity-Layer/sgl-network-node release)
curl -sSf https://grid.x402compute.cc/install.sh | sh

# 2. Local inference runtime
brew install llama.cpp            # macOS; see repo README for Linux

• Confidence: 99% confidence
• Finding: Fetching and executing an external script from https://grid.x402compute.cc/install.sh grants that remote content full execution on the machine. Because this skill is explicitly agent-runnable and aimed at provisioning node operators with wallets, models, and network access, compromise of the installer path could lead to host takeover, credential theft, wallet compromise, persistence, or tampering with served inference.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# 1. Install the sgl node CLI (Singularity-Layer/sgl-network-node release)
curl -sSf https://grid.x402compute.cc/install.sh | sh

# 2. Local inference runtime
brew install llama.cpp            # macOS; see repo README for Linux

• Confidence: 98% confidence
• Finding: The `| sh` construct turns a network fetch into immediate shell execution, removing opportunities for inspection and increasing the blast radius of any compromise. In this context, where the host may contain operator wallets, model assets, API credentials, and background services, the chaining pattern materially increases the likelihood and severity of silent compromise.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

sgl price show
# llama-3.2-3b   in $0.005000 / out $0.005000  [suggested]   (band: in $0.0025–$0.025 ...)

sgl price set --model llama-3.2-3b --input 0.004 --output 0.004   # undercut to win more jobs
sgl price reset --model llama-3.2-3b                              # back to suggested
```

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

# llama-3.2-3b   in $0.005000 / out $0.005000  [suggested]   (band: in $0.0025–$0.025 ...)

sgl price set --model llama-3.2-3b --input 0.004 --output 0.004   # undercut to win more jobs
sgl price reset --model llama-3.2-3b                              # back to suggested
```

Notes:

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

|---|---|
| `GET /processors` | your processors (public catalogue when no credential) |
| `POST /processors` | deploy |
| `GET`/`PATCH`/`DELETE /processors/{slug}` | detail, update code or manifest, delete |
| `PUT /processors/{slug}/secrets` | set secret values |
| `POST /processors/{slug}/rotate-token` | new invoke token |
| `PUT /processors/{slug}/pause` · `/listing` | pause or resume, list or unlist |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| `POST /processors/{slug}/rotate-token` | new invoke token |
| `PUT /processors/{slug}/pause` · `/listing` | pause or resume, list or unlist |
| `GET /processors/{slug}/runs` · `/runs/{id}` · `/earnings` · `/kv` | logs, one run, revenue, state |
| `GET`/`PUT`/`DELETE /processors/{slug}/webhook` · `POST …/webhook/test` | webhooks |

**Two things a key cannot do**, and neither is a publisher action: `POST …/suspend` (moderation,
admin wallets only) and `POST /processors/auth-session` (minting a read session from a bearer).

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp1

High

• Category: MCP Least Privilege
• Confidence: 79% confidence
• Finding: The script reads credentials from environment variables, but the finding indicates that this capability is not declared in the skill's permission model. In an agent-skill setting, undeclared env access weakens reviewability and can let the skill consume sensitive secrets without the platform's explicit authorization surface reflecting that behavior.

Credential Access

High

• Category: Privilege Escalation

Content

- Adapter calls (chat / models) use the pod-scoped integration key `sk-sglpod-int-…` as
    `Authorization: Bearer …`. Provide it with --key or the POD_INTEGRATION_KEY env var.

Credentials are read ONLY from explicit environment variables. No .env auto-loading here.

Usage:
  python agent_pod.py catalog

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Adapter calls (chat / models) use the pod-scoped integration key `sk-sglpod-int-…` as
    `Authorization: Bearer …`. Provide it with --key or the POD_INTEGRATION_KEY env var.

Credentials are read ONLY from explicit environment variables. No .env auto-loading here.

Usage:
  python agent_pod.py catalog

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Adapter calls (chat / models) use the pod-scoped integration key `sk-sglpod-int-…` as
    `Authorization: Bearer …`. Provide it with --key or the POD_INTEGRATION_KEY env var.

Credentials are read ONLY from explicit environment variables. No .env auto-loading here.

Usage:
  python agent_pod.py catalog

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Adapter calls (chat / models) use the pod-scoped integration key `sk-sglpod-int-…` as
    `Authorization: Bearer …`. Provide it with --key or the POD_INTEGRATION_KEY env var.

Credentials are read ONLY from explicit environment variables. No .env auto-loading here.

Usage:
  python agent_pod.py catalog

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Adapter calls (chat / models) use the pod-scoped integration key `sk-sglpod-int-…` as
    `Authorization: Bearer …`. Provide it with --key or the POD_INTEGRATION_KEY env var.

Credentials are read ONLY from explicit environment variables. No .env auto-loading here.

Usage:
  python agent_pod.py catalog

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/ai-machines.md:130