Agent Tools (x402 + MCP + A2A)

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 0.1.2

Overview

This skill is a disclosed directory/search helper for finding paid APIs, MCP servers, and agents, with clear warnings that payments remain user-controlled.

Before installing, verify that you trust the agent-tools-mcp package and publisher, and require explicit approval before connecting wallets, signing x402 payments, or calling paid third-party services.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned Executable Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:4
Vulnerability Type: Unpinned package installation and supply-chain exposure
Risk Level: Medium

Vulnerable Code Snippet

yaml

metadata: {"openclaw": {"emoji": "🛒", "homepage": "https://agent-tools.cloud", "requires": {"bins": ["uvx"]}, "install": [{"id": "uv", "kind": "uv", "package": "agent-tools-mcp", "bins": ["agent-tools-mcp"], "label": "Install via uv (recommended)"}, {"id": "pip", "kind": "pip", "package": "agent-tools-mcp", "bins": ["agent-tools-mcp"], "label": "Install via pip"}]}}

Technical Analysis

The installation metadata directs uv or pip to install agent-tools-mcp without specifying an exact version, integrity hash, or verified artifact provenance. Consequently, the package registry resolves the dependency at installation time, and the installed executable may differ from the version reviewed when this Skill was published.

The project contains only SKILL.md; it does not vendor the dependency's implementation or provide a lockfile, hashes, signatures, or other data that would allow the installed code to be verified against this audit. This creates a supply-chain trust gap: compromise of the package account, registry, build pipeline, or a future package release could cause attacker-controlled code to be installed and executed.

Attack Path

1. An attacker compromises the agent-tools-mcp package publication account, its build/release pipeline, or another component of its distribution process.
2. The attacker publishes a malicious release under the expected package name.
3. A user enables or installs the Skill through the declared uv or pip installation specification.
4. Because no exact version or artifact hash is specified, the installer resolves the attacker-controlled release.
5. The package's installation or runtime code executes in the local Agent environment.
6. The malicious code abuses any permissions available to that process, potentially accessin ...[truncated 718 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin agent-tools-mcp to a reviewed, exact version in both uv and pip installation specifications.
2. Require cryptographic hashes for the expected distribution artifacts where the installer supports hash verification.
3. Publish and verify signed release provenance, such as trusted package signatures or attestations tied to the reviewed source revision.
4. Provide a lockfile or equivalent immutable dependency manifest, including transitive dependencies.
5. Link the pinned package artifact to the corresponding source commit and retain reproducible-build evidence where feasible.
6. Review dependency updates before changing the pinned version; do not automatically track the latest registry release.
7. Run the MCP server in a sandbox with least-privilege filesystem and network access.
8. Do not expose wallet keys, payment credentials, unrelated secrets, or unnecessary Agent tools to the dependency process.
9. Monitor the package source, maintainer ownership, release history, and registry metadata for unexpected changes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.