Altcoin Season

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:39 AM UTC
• Version: 1.0.0

Overview

This skill openly provides a paid crypto signal, but it needs review because it gives the agent a raw wallet private key for automatic per-call payments without documented spend controls.

Install only if you are comfortable with agent-initiated paid requests. Use a dedicated low-balance wallet on Base with only the USDC needed for expected calls, never a primary wallet, and monitor each charge because the skill does not document hard spending limits or per-call confirmation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:6

Finding

Automatic Paid Requests Use an Unrestricted EVM Private Key Without Spending Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6-9, 25-35, and 46
Vulnerability Type: Excessive secret capability and uncontrolled payment authorization
Risk Level: Medium

Vulnerable Code

yaml

metadata:
  openclaw:
    requires:
      env:
        - EVM_PRIVATE_KEY
    primaryEnv: EVM_PRIVATE_KEY

markdown

The x402 client handles payment authorisation automatically. No API key, no account, no subscription required — just an EVM wallet with USDC on Base mainnet.

```python
# Example using the x402-python client
from x402.client import x402_get

response = x402_get(
    url="https://apexrunner.ai/signals/altcoin-season",
    private_key=os.environ["EVM_PRIVATE_KEY"]
)
print(response.json())

text

```markdown
**$0.25/call** — standard price

Technical Analysis

The skill requires direct access to an EVM private key and passes that key to the x402_get client. The client is explicitly expected to authorize a cryptocurrency payment automatically for each request.

A private key provides transaction-signing authority rather than narrowly scoped permission to retrieve a market signal. The documented flow does not require interactive payment confirmation or specify controls for:

• Maximum payment amount per request
• Aggregate or daily spending
• Expected payment recipient
• Expected token and blockchain
• Repeated or recursive invocations
• Rejection of payment terms that differ from the advertised price
• Use of a restricted, low-balance, or delegated wallet

Consequently, a read-only data request receives substantially more authority than it needs. Although the documentation discloses the nominal price, disclosure alone does not enforce that price or limit the number of calls.

The private key is also exposed to the agent process and the imported x402 client implementation. The reviewed project contains no pinned dependency definition or local implementation that would allow the behavior of that client to be verifi ...[truncated 1638 chars]

Remediation

View remediation

Remediation Suggestions

1. Use a dedicated payment wallet with only the minimum balance required for expected calls. Never use a primary treasury or personal wallet key.
2. Require explicit user approval before each paid request, displaying the recipient, chain, token, exact amount, endpoint, and cumulative session cost.
3. Enforce payment policy in code, including:
   • A maximum amount per call
   • Per-session and daily spending limits
   • An allowlisted recipient address
   • Base mainnet chain-ID validation
   • USDC contract-address validation
   • Rejection of payment terms that differ from the displayed price
4. Prevent uncontrolled repetition by adding rate limits, request deduplication, recursion limits, and a maximum number of paid calls per task.
5. Replace the unrestricted private key where possible with a scoped session key, delegated authorization, smart-account policy, or payment mechanism that cannot transfer unrelated assets.
6. Isolate the signing operation in a narrowly scoped wallet service or hardware-backed signer rather than exposing the raw private key to the full agent process.
7. Pin and audit the x402 dependency by documenting an exact package name, version, integrity hash, and trusted source. Verify that it does not log, persist, or transmit private-key material.
8. Fail closed if the endpoint redirects, the TLS identity is invalid, payment metadata is incomplete, or any payment term differs from the locally configured policy.
9. Provide cost telemetry showing each authorized charge and cumulative spending, and stop execution when the configured budget is exhausted.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to use an EVM private key for automated x402 payment authorization, but it does not clearly warn that this can spend on-chain funds or emphasize safe handling of a highly sensitive credential. In an agent setting, this creates a real risk of unintended paid requests, wallet draining through repeated calls, or unsafe key exposure if users provide a broadly privileged wallet key.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.