x402 Private Search

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:33 PM UTC
• Version: 1.0.0

Overview

The skill appears purpose-built for x402 paid API requests, but it needs review because it can automatically authorize wallet payments and handles private keys in risky ways.

Install only if you are comfortable giving this skill spending authority for a dedicated low-balance test wallet. Prefer --key-file over X402_PRIVATE_KEY or --key, do not reuse a valuable wallet, inspect payment terms and endpoints manually, and be aware that npm dependencies are fetched at install time.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/x402-fetch.mjs:41

Finding

Automatic payment signing lacks destination and spending restrictions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wallet-gen.mjs:15

Finding

Private keys can be exposed through output, command arguments, and inherited environment variables

Content

View full analysis

EVM private key (hex, with or without 0x prefix) --key-file File containing the private key --method HTTP method (default: GET) --body Request body (for POST) --header Extra header (repeatable) --quiet Suppress stderr info messages Environment: X402_PRIVATE_KEY EVM private key (fallback if --key not provided) X402_KEY_FILE Key file path (fallback if --key-file not provided) ``` ```js const url = args[0]; let privateKey = process.env.X402_PRIVATE_KEY || ""; let keyFile = process.env.X402_KEY_FILE || ""; ``` The documentation additionally recommends: ```bash export X402_PRIVATE_KEY=$(cat ~/.x402-client/wallet.key) ``` ### Technical Analysis The wallet generator always writes the private key to standard output, including when the caller requests storage in a mode-`0600` key file. In agent, CI, terminal-recording, or managed execution environments, stdout may be captured and retained. The fetch utility also supports passing a private key directly in a command-line argument. Depending on the operating system and e ...[truncated 1562 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:23

Finding

Wallet-sensitive dependencies are installed from mutable version ranges without a lockfile

Content

View full analysis

package.json << 'EOF' { "name": "x402-client", "version": "1.0.0", "private": true, "type": "module", "dependencies": { "@x402/fetch": "^2.3", "@x402/evm": "^2.3", "viem": "^2.0" } } EOF npm install --quiet 2>&1 | tail -3 ``` ### Technical Analysis The setup script creates a package manifest containing caret version ranges and runs `npm install` without a committed lockfile. Consequently, installations performed at different times can resolve different package and transitive-dependency versions. The installed packages operate in a wallet-signing context. They are loaded into the same Node.js process that receives the private key and constructs payment authorizations. A compromised upstream release or transitive dependency could therefore access wallet material or modify payment behavior. Standard npm installation may also execute dependency lifecycle scripts unless explicitly disabled. There is no evidence in the reviewed project that the named packages are currently malicious. The confirmed weakness is that the installation process does not provide reproducible, reviewed dependency resolution or constrain install-time script execution. ### Attack Path 1. A package maintainer account, package release, or transitive dependency is compromised, or an unsafe version is published within one of the accepted ranges. 2. A user runs `scripts/setup.sh` after that publication. 3. `npm install` resolves the mutable range to the affected version because no audited lockfile fixes the dependency graph. 4. Malicious lifecycle code may run during installation, or malicious runtime code may load when `x402-fetch.mjs` executes. 5. Runtime code can access the signer context, alter payment parameters, or attempt to disclose ...[truncated 606 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill performs sensitive actions involving network access and environment-based secret handling, but it does not declare any explicit tool scope or permissions. This creates a governance gap: an agent may invoke capabilities broader than the user expects, making secret exposure or unintended outbound requests more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs users to place a blockchain private key directly into an environment variable, which increases the chance of leakage through shell history, process inspection, logs, crash reports, or downstream tools that read inherited environment variables. Because this key authorizes spending from the wallet, compromise can lead to unauthorized payments and loss of funds.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This shell script creates directories and files, runs npm install, and copies scripts into the target directory. While the script's purpose is setup and installation, it does not clearly disclose beforehand that it will write package.json, install dependencies from the network, and copy executable scripts into a user directory.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.