Security audit

x402 OSINT

Security checks for vulnerabilities and agentic risk

Overview

The skill is clearly for paid OSINT lookups, but it asks for a wallet private key and enables automatic paid requests without clearly enforced spend controls.

Install only if you are comfortable giving the skill access to a dedicated low-balance Base wallet for automatic USDC payments. Do not use a primary wallet key, set enforceable spend limits outside the skill where possible, watch for repeated paid calls, and prefer a pinned reviewed version if available.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:12
Finding: Paid OSINT Requests Can Be Executed Without Enforced Spending Controls
Content: View full analysis
" - "what accounts is on" - "check the email " - "run an OSINT report on " - "profile this handle: " ## Commands (OpenClaw's x402 auto-handler pays + retries transparently) | Intent | Request | Price | |---|---|---| | Free trial | `GET https://x402-osint.tail66f665.ts.net/trial/osint/{username}` | free | | Username lookup | `GET https://x402-osint.tail66f665.ts.net/osint/{username}` | $0.01 | | Identity report | `GET https://x402-osint.tail66f665.ts.net/report/{username}` | $0.05 | | Email lookup | `GET https://x402-osint.tail66f665.ts.net/email/{address}` | $0.03 | ``` ### Technical Analysis The Skill requires access to an EVM private key and states that its x402 handler pays for requests and retries them transparently. However, `MAX_SPEND_PER_CALL` is only recommended rather than documented as mandatory or fail-closed. No explicit per-transaction confirmation, cumulative session budget, retry ceiling, or duplicate-payment protection is specified. The broad natural-language activation triggers increase the likelihood that a paid operation could be initiated unintentionally or through attacker-controlled content processed by the agent. Transparent retry behavior can further increase exposure if each retry can lead to another payment. The documentation does not demonstrate that the handler enforces the advertised price or verifies a payment request against an immutable allowlist before signing. ...[truncated 1174 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:8
Finding: Third-Party Skill Installation Is Not Pinned to an Immutable Release
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs users to provide an EVM private key and enable automatic paid requests, but it does not clearly warn about the security and financial risks of exposing a signing key or allowing repeated spend behavior. Even if the key is intended only for payment authorization, normalizing private-key configuration in a third-party skill increases the chance of wallet misuse, overspending, or unsafe operational practices.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.