Security audit

x402lint

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly transparent about being a remote paid scanner, but its MCP setup asks users to run an unpinned npm package with a wallet private key and scanned origins are publicly listed by default.

Use the free endpoints without a wallet first. Only configure paid MCP tools with a dedicated low-balance wallet, prefer a pinned and reviewed `x402lint-mcp` version, avoid relying on a generic `PRIVATE_KEY`, and do not scan internal, confidential, customer-specific, or third-party origins unless public listing is acceptable.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:103
Finding: Unpinned npm Package Execution with Access to a Wallet Private Key
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:28
Finding: Scanned Origins Are Published in a Public Directory by Default
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
| POST | /v1/listing | FREE listing control (owner-verified origins only, else 403) — listed:false removes the origin from the directory; suppressEnrichment:true hides auto-collected branding. (10/min) |

bash
curl "https://api.x402lint.dev/v1/status?url=https://api.example.dev" curl https://api.x402lint.dev/v1/checks curl "https://api.x402lint.dev/v1/directory?sort=grade&pageSize=20" curl "https://api.x402lint.dev/v1/project?host=api.example.dev"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
| POST | /v1/listing | FREE listing control (owner-verified origins only, else 403) — listed:false removes the origin from the directory; suppressEnrichment:true hides auto-collected branding. (10/min) |

bash
curl "https://api.x402lint.dev/v1/status?url=https://api.example.dev" curl https://api.x402lint.dev/v1/checks curl "https://api.x402lint.dev/v1/directory?sort=grade&pageSize=20" curl "https://api.x402lint.dev/v1/project?host=api.example.dev"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
| POST | /v1/listing | FREE listing control (owner-verified origins only, else 403) — listed:false removes the origin from the directory; suppressEnrichment:true hides auto-collected branding. (10/min) |

bash
curl "https://api.x402lint.dev/v1/status?url=https://api.example.dev" curl https://api.x402lint.dev/v1/checks curl "https://api.x402lint.dev/v1/directory?sort=grade&pageSize=20" curl "https://api.x402lint.dev/v1/project?host=api.example.dev"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
| POST | /v1/listing | FREE listing control (owner-verified origins only, else 403) — listed:false removes the origin from the directory; suppressEnrichment:true hides auto-collected branding. (10/min) |

bash
curl "https://api.x402lint.dev/v1/status?url=https://api.example.dev" curl https://api.x402lint.dev/v1/checks curl "https://api.x402lint.dev/v1/directory?sort=grade&pageSize=20" curl "https://api.x402lint.dev/v1/project?host=api.example.dev"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
| POST | /v1/listing | FREE listing control (owner-verified origins only, else 403) — listed:false removes the origin from the directory; suppressEnrichment:true hides auto-collected branding. (10/min) |

bash
curl "https://api.x402lint.dev/v1/status?url=https://api.example.dev" curl https://api.x402lint.dev/v1/checks curl "https://api.x402lint.dev/v1/directory?sort=grade&pageSize=20" curl "https://api.x402lint.dev/v1/project?host=api.example.dev"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
| POST | /v1/listing | FREE listing control (owner-verified origins only, else 403) — listed:false removes the origin from the directory; suppressEnrichment:true hides auto-collected branding. (10/min) |

bash
curl "https://api.x402lint.dev/v1/status?url=https://api.example.dev" curl https://api.x402lint.dev/v1/checks curl "https://api.x402lint.dev/v1/directory?sort=grade&pageSize=20" curl "https://api.x402lint.dev/v1/project?host=api.example.dev"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
bash
# Full conformance scan ($0.15) — read-only, ~75s budget, or served from the <24h cache curl -X POST https://api.x402lint.dev/v1/scan \ -H "Content-Type: application/json" \ -d '{"url":"https://api.example.dev"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: This example instructs use of a PAYMENT-SIGNATURE header tied to a paid x402 authorization, and the skill later recommends configuring an EVM private key for an MCP server. In an agent setting, this creates real risk of unauthorized value transfer if the skill can induce payment-bearing requests to an external service without strong user approval and wallet isolation.
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
md
# 2) Sign an x402 'exact' USDC authorization for the Base accepts[] rail, then retry. # Standard @x402 V2 clients send PAYMENT-SIGNATURE; legacy clients send X-PAYMENT. curl -s -X POST "https://api.x402lint.dev/v1/scan" \ -H "Content-Type: application/json" -d '{"url":"https://api.example.dev"}' \ -H "PAYMENT-SIGNATURE: <payload>" # → 200 { "grade": "B", "score": 82, "results": [ … ], "reportUrl": "…" }