Security audit
Security checks for vulnerabilities and agentic risk
The skill has a coherent purpose, but its signing tools can authorize excessive payments or unintended wallet transactions without sufficient checks.
Start with secret-free discovery. Avoid unattended direct-key payments, registration or staking until spending limits and transaction validation are enforced. Use a dedicated low-balance wallet, task-specific credentials and approved HTTPS hosts. Keep downloads in an empty dedicated directory. Before using webhooks to grant goods or credits, add freshness checks and duplicate-event protection.
scripts/pay_base.pyRemote Base payment quotes become unrestricted spending authorizations
The endpoint receives a valid Base USDC TransferWithAuthorization for its chosen amount and recipient. It can redeem that authorization subject to wallet balance and contract checks. The signer defaults to a one-hour validity period.
scripts/solana_signing.pySolana USDC payment flow permits endpoint-selected assets and amounts
A malicious endpoint can obtain a signed transfer of another compatible six-decimal SPL token held by the wallet, or an excessive amount, rather than the intended USDC purchase. Success depends on valid token accounts, balances and chain checks.
scripts/stake_sgl.pyStaking helper signs remote transactions without validating staking intent
The response provider can obtain and submit wallet-signed transfers or other state changes unrelated to the requested staking action, subject to required signers, balances and chain validation.
scripts/register_agent.pyEVM registration and updates execute API-selected contract calls
A malicious response can cause a token transfer, approval or other wallet-authorized contract call instead of registration or URI update. The client signs and broadcasts the call automatically. Impact depends on wallet holdings and the selected contract's authorization rules.
scripts/solana_signing.pySolana registration and updates blindly sign prepared messages
The client can sign and broadcast transfers or other wallet-authorized state changes unrelated to agent registration or metadata updates. For registration, an attacker can construct a message requiring both the wallet and the generated asset signer.
scripts/verify_webhook_payment.pyWebhook verification accepts replayed signed payment events
The verifier repeatedly returns success for the same signed event. A fulfillment integration using that success as authorization can grant duplicate credits, settlement or delivery unless it separately enforces idempotency.
scripts/consume_product.pyProduct downloads can overwrite unrelated working-directory files
A response naming an existing configuration, source or document file can overwrite it with remote bytes. Existing symbolic links are also followed, potentially affecting a target outside the working directory. No automatic execution of the downloaded content was established.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
print(f"Checking credits for: {endpoint_slug}")
print(f"Wallet: {wallet}")
response = requests.get(
url,
params={"action": "balance", "wallet": wallet},
headers={"Accept": "application/json"},
The private key is used locally rather than transmitted, and sending a payment signature is expected in this purchasing skill. However, the script signs the server-supplied recipient and amount without an independently approved price or spending limit, allowing a malicious or compromised payment response to obtain a redeemable USDC authorization exceeding the user's intended purchase.
# Step 4: Make request with payment
print("\nStep 3: Submitting payment and requesting download...")
response = requests.get(
api_url,
headers={
"X-Payment": json.dumps(payment_payload),
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
headers: Optional[Dict[str, str]] = None,
timeout: int = 60,
) -> Dict[str, Any]:
response = requests.post(url, json=body, headers=headers or {}, timeout=timeout)
try:
data = response.json()
except Exception:
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
if banner_url:
print(f" Banner: {banner_url}")
response = requests.post(url, json=data, headers=headers)
if response.status_code in [200, 201]:
result = response.json()
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
print(f"Unlisting endpoint: {slug} from marketplace...")
response = requests.post(url, json=data, headers=headers)
if response.status_code == 200:
result = response.json()
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
def get_endpoint_info(slug: str, api_key: Optional[str] = None) -> dict:
response = requests.get(
f"{API_BASE}/agent/endpoints",
params={"slug": slug},
headers=_build_headers(api_key),
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
"details": details,
}
response = requests.get(
f"{API_BASE}/agent/endpoints",
params={"action": "stats", "endpoint_ids": endpoint_id},
headers={"Accept": "application/json"},
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
if not api_key:
return {"error": "Update requires X_API_KEY or API_KEY"}
response = requests.patch(
f"{API_BASE}/agent/endpoints",
params={"slug": slug},
headers={**_build_headers(api_key), "Content-Type": "application/json"},
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
def set_webhook(slug: str, webhook_url: str) -> dict:
"""Set or update the webhook URL for an endpoint."""
api_key = _load_api_key()
response = requests.patch(
f"{API_BASE}/agent/endpoints",
params={"slug": slug},
json={"webhook_url": webhook_url},
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
def remove_webhook(slug: str) -> dict:
"""Remove the webhook URL from an endpoint."""
api_key = _load_api_key()
response = requests.patch(
f"{API_BASE}/agent/endpoints",
params={"slug": slug},
json={"webhook_url": None},
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
def get_webhook_info(slug: str) -> dict:
"""Check if an endpoint has a webhook configured."""
api_key = _load_api_key()
response = requests.get(
f"{API_BASE}/agent/endpoints",
params={"slug": slug},
headers={"X-API-Key": api_key, "Accept": "application/json"},
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
signed_tx = VersionedTransaction(raw_tx.message, [keypair, *(extra_signers or [])])
signed_tx_base64 = base64.b64encode(bytes(signed_tx)).decode()
response = requests.post(
rpc_url,
json={
"jsonrpc": "2.0",
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
# ─── API helpers ─────────────────────────────────────────────────────────────
def _get(path: str) -> dict:
r = requests.get(f"{BASE}{path}", timeout=TIMEOUT)
data = r.json()
if not r.ok:
sys.exit(f"GET {path} failed ({r.status_code}): {data.get('error', data)}")
The dangerous flow is not disclosure of the BASE environment variable: _prepare_sign_submit blindly signs every transaction returned by the configured server and sends the signed transactions back. A compromised staking service or malicious endpoint override could supply transfers or authority-changing instructions unrelated to the requested staking action, potentially draining assets controlled by the wallet; the printed warning does not validate transaction contents.
def _post(path: str, body: dict) -> dict:
r = requests.post(f"{BASE}{path}", json=body, timeout=TIMEOUT)
data = r.json()
if not r.ok:
msg = data.get("error", data)
X402_API_BASE can select an arbitrary destination, including an unencrypted HTTP URL, and the script sends the worker API key there without validating the scheme or host. If an attacker can influence this configuration, the key and feedback contents can be disclosed; the reputation-writing context makes unauthorized use of the key consequential, although this requires configuration influence and is not evidence of intentional exfiltration.
else:
body["agentId"] = agent_id
response = requests.post(
url,
json=body,
headers={
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
def _resolve_listing(listing_type: str, listing_ref: str) -> Dict[str, str]:
if listing_type == "endpoint" and not listing_ref.startswith("http") and len(listing_ref) < 64:
response = requests.get(f"{STUDIO_BASE}/api/public/endpoints/{listing_ref}", timeout=30)
if response.status_code == 200:
data = response.json()
return {"listing_id": data["id"], "listing_type": "endpoint", "name": data.get("name") or listing_ref}
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
if listing_ref.startswith("http"):
slug = listing_ref.rstrip("/").split("/")[-1]
if listing_type == "endpoint":
response = requests.get(f"{STUDIO_BASE}/api/public/endpoints/{slug}", timeout=30)
if response.status_code == 200:
data = response.json()
return {"listing_id": data["id"], "listing_type": "endpoint", "name": data.get("name") or slug}
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
return {"listing_id": data["id"], "listing_type": "endpoint", "name": data.get("name") or slug}
# fallback to marketplace search by id/slug
response = requests.get(f"{API_BASE}/api/marketplace", params={"search": listing_ref, "limit": 50}, timeout=30)
response.raise_for_status()
data = response.json()
listings = data.get("listings", [])
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
headers=headers,
)
response = requests.put(
url,
params=params,
json=data,
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
except Exception as exc:
return {"error": f"Failed to build {selected_network} payment: {exc}"}
response = requests.put(
url,
params=params,
json=data,
Endpoint management is consistent with the declared purpose, and authenticated updates and deletion are expected. However, main() loads an API key for every command, and get_endpoint_info() transmits it whenever available. Consequently, list, info, and the endpoint lookup within stats use credentials even though they perform no signing or owner-scoped writes. This conflicts with the description's explicit credential-use restriction. Read-only requests can proceed without a key, but automatic credential use when one is present is not gated as declared. No unrelated network destination or additional undeclared primary purpose is evident.
Campaign management is not declared among the supported capabilities. The shown commands operate on campaigns rather than API endpoints, credits, webhooks, marketplace listings, agent identities, or staking positions. The dashboard credential is consistent with the declared optional authentication methods, but that does not establish campaign management as a declared capability. The script implementation is not supplied, so this assessment is limited to the operations exposed by the shown commands.
Fundraiser campaign management is the code's primary purpose, but it is not identified in the declared capabilities. Although the description broadly mentions credentialed Singularity operations, fundraising is materially distinct from managing monetized API endpoints, agent identities, or staking. The authentication mechanism and service domain are consistent with the description; the mismatch is the undeclared campaign-management functionality, not suspicious credential handling or direct on-chain transfers.
Endpoint information retrieval and credentialed owner operations are consistent with the description. However, campaign management is a distinct exposed capability that is not described or visibly connected to the declared endpoint, payment, identity, or staking workflows. The supplied chunk shows script invocations only; it does not establish their internal implementation or any actual movement of funds.
Referenced artifact was not completely inspected
`ows_cli.py` | `references/pay-per-request.md`, `references/credit-based.md`, `references/agentkit-benefits.md`, `references/openwallet-ows.md` |