T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:6
- Finding
- Automatic Paid Requests Use an Unrestricted EVM Private Key Without Local Spending Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 6-9, 33-42, and 62-63 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```yaml metadata: openclaw: requires: env: - EVM_PRIVATE_KEY primaryEnv: EVM_PRIVATE_KEY ``` ```markdown The x402 client handles payment authorisation automatically. No API key, no account, no subscription required — just an EVM wallet with USDC on Base mainnet. ```python # Example using the x402-python client from x402.client import x402_get response = x402_get( url="https://apexrunner.ai/signals/capital-rotation-signal", private_key=os.environ["EVM_PRIVATE_KEY"] ) print(response.json()) ``` ``` ```markdown ## Pricing **$12.00/call** — standard price ``` ### Technical Analysis The skill requires access to a raw EVM private key and passes that key to a payment-capable client. The documentation explicitly states that payment authorization occurs automatically. However, the skill does not define or demonstrate any local maximum-price check, cumulative spending budget, invocation limit, transaction preview, recipient validation, or per-payment user confirmation. A raw private key provides signing authority rather than a narrowly scoped capability. Supplying it to a third-party client therefore exposes more sensitive authority than is required for an ordinary market-data request. The reviewed file does not establish that the private key is transmitted to the remote server, so remote key exfiltration is not asserted. The confirmed risk is that the local client receives signing authority and can automatically authorize paid requests. Although the documented standard price is `$12.00/call`, that amount is descriptive rather than an enforced limit in the shown code. Repeated, accidental, or agent-initiated calls can consequently cause repeated USDC expenditure. ### Attack Path 1. The skill is invoked to retrieve the capital-rotation ...[truncated 1586 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit user confirmation before every payment. Display the exact amount, token, network, recipient, endpoint, and expected purpose before signing. 2. Enforce a local maximum price per request. Reject any payment requirement above the expected amount rather than relying on the remote service's advertised pricing. 3. Implement cumulative budgets and rate limits, including maximum daily expenditure, maximum calls per session, and retry limits. 4. Use a dedicated low-balance payment wallet instead of a primary wallet. Do not expose a wallet that controls unrelated or high-value assets. 5. Prefer a narrowly scoped session key, smart-account permission, allowance-limited mechanism, or other restricted payment credential where supported. 6. Validate the Base mainnet chain ID, payment token contract, recipient address, and amount before signing. 7. Ensure that private keys are never transmitted, printed, included in exceptions, or written to logs. Keep signing isolated in a secure wallet or signing service where possible. 8. Pin the x402 client to a reviewed version, verify package integrity, and audit its signing and payment-validation behavior before deployment. 9. Add safeguards against automatic retries of paid requests and make payment operations non-idempotent only with explicit user awareness. ]]>