Security audit

x402-direct

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only x402 service directory skill with disclosed paid search behavior, but users should require confirmation before any paid request.

Install only if you want an agent to discover x402-enabled API services. Configure the agent to prefer free browse/detail endpoints and require explicit approval, budget limits, and retry limits before using the paid search endpoint or any wallet-backed x402 client.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README explicitly describes a paid search endpoint and even lists its price, but it does not clearly warn that invoking the search flow will spend funds or require explicit user approval before payment. In an agent skill context, that omission is risky because an agent may autonomously follow the documented workflow and trigger small but real monetary charges repeatedly without informed consent.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The manifest description says the skill triggers on phrases such as "x402 API" and "search x402," which are short and context-light enough to overlap with general discussion about the x402 ecosystem rather than a clear intent to use this specific directory skill. The trigger guidance also mixes explicit phrases with broad concepts like "agent-to-agent payments" and "crypto-native API discovery," making activation scope ambiguous.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly recommends use of an x402-aware client that automatically handles payment, but it does not require explicit user consent or spending limits before funds are spent. In an agent setting, this can lead to unintended micropayments, repeated charges from retries or loops, and silent wallet usage against a paid endpoint.

Vague Triggers

Low

Confidence: 83% confidence
Finding: Because this is a manifest file, vague-trigger review applies. Triggers like "paid API search," "agent payments," and "crypto API directory" are relatively generic and could match unrelated user requests, making unintended invocation more likely than the more specific x402-prefixed triggers.

Static analysis

No suspicious patterns detected.