x402 Compute

• Outcome: Review
• Latest audit: Jul 11, 2026 · 4:29 PM UTC
• Version: 1.10.0

Overview

This compute-management skill is coherent, but it needs Review because it can spend wallet funds and manage servers while also persisting root credentials and recommending unverified runtime installers.

Install only if you are comfortable giving an agent cloud-management and payment authority. Use a dedicated low-balance wallet, prefer SSH keys over password fallback, delete any .compute_password_* files immediately, avoid --yes unless the exact spend and instance are known, protect API-key output from logs, pin or review dependencies, and inspect the node installer instead of blindly running curl | sh.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The script retrieves a one-time root password from the API and persists it to disk in a predictable local file. Even though it sets mode 600 and labels the value as sensitive, writing root credentials to local storage increases the chance of credential disclosure through local compromise, backups, shell working-directory leakage, or accidental collection by other tooling.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The run subcommand forwards arbitrary arguments directly to the OWS CLI, enabling any wallet operation that the installed OWS tool supports, not just the compute-specific signing and management flows described by the skill. In an agent setting, this can let prompts or downstream tooling trigger unintended high-risk wallet actions such as key management, transaction signing, export-like operations, or policy changes, expanding the attack surface far beyond the intended capability.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation gives an agent end-to-end lifecycle steps that include destroying a compute instance, but it does not explicitly warn that deletion is irreversible and may permanently remove data, endpoints, and running services. In an agent-executed context, this increases the risk of unintended destructive actions if the workflow is followed automatically or with insufficient user confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs operators to execute a remote installer via `curl ... | sh`, which runs unreviewed code directly on the host with no integrity verification, pinning, or review step. In this skill’s context, that host is a node operator machine tied to a staked wallet and likely holding model assets and credentials, so a compromised installer endpoint or supply-chain attack could immediately lead to host compromise and wallet/credential theft.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script prints the returned API key directly to stdout, which can leak credentials into terminal scrollback, shell session recordings, CI logs, remote terminal multiplexers, or other shared logging systems. In this skill's context, that key grants access to a newly provisioned OpenAI-compatible inference endpoint, so accidental disclosure could allow unauthorized use and billing abuse.

Credential Access

High

• Category: Privilege Escalation

Content

access = data.get("access", {})
    password = access.get("password", "")

    print("One-time access credentials:")
    print(f"  Username: {access.get('username', 'root')}")
    print(f"  IP:       {access.get('ip_address', 'pending')}")
    print(f"  Password: [SENSITIVE — written to .compute_password_{instance_id}]")

• Confidence: 91% confidence
• Finding: access credentials

Unpinned Dependencies

Low

• Category: Supply Chain

Content

eth-account>=0.8.0
web3>=6.0.0
requests>=2.28.0
python-dotenv>=1.0.0

• Confidence: 94% confidence
• Finding: eth-account>=0.8.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

eth-account>=0.8.0
web3>=6.0.0
requests>=2.28.0
python-dotenv>=1.0.0
solders>=0.20.0

• Confidence: 98% confidence
• Finding: web3>=6.0.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

eth-account>=0.8.0
web3>=6.0.0
requests>=2.28.0
python-dotenv>=1.0.0
solders>=0.20.0

• Confidence: 99% confidence
• Finding: requests>=2.28.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

eth-account>=0.8.0
web3>=6.0.0
requests>=2.28.0
python-dotenv>=1.0.0
solders>=0.20.0

• Confidence: 91% confidence
• Finding: python-dotenv>=1.0.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

web3>=6.0.0
requests>=2.28.0
python-dotenv>=1.0.0
solders>=0.20.0

• Confidence: 90% confidence
• Finding: solders>=0.20.0

Known Vulnerable Dependency: web3==6.0.0 — 1 advisory(ies): CVE-2026-40072 (web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling)

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: web3==6.0.0

Known Vulnerable Dependency: requests==2.28.0 — 7 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +4 more

High

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: requests==2.28.0

Known Vulnerable Dependency: python-dotenv==1.0.0 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: python-dotenv==1.0.0

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/ai-machines.md:130