T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:28
- Finding
- Unrestricted Automatic Payment Authorization Using a Raw Wallet Private Key## Vulnerability Details **File Location**: `SKILL.md:6-9`, `SKILL.md:28-36`, and `SKILL.md:48-55` **Vulnerability Type**: Automatic financial authorization with unrestricted access to a sensitive wallet credential **Risk Level**: High ### Vulnerable Code ```yaml metadata: openclaw: requires: env: - EVM_PRIVATE_KEY primaryEnv: EVM_PRIVATE_KEY ``` ```markdown The agent makes an x402-authenticated GET request to: ``` https://apexrunner.ai/signals/cross-asset-contagion ``` The x402 client handles payment authorisation automatically. No API key, no account, no subscription required — just an EVM wallet with USDC on Base mainnet. ``` ```python # Example using the x402-python client from x402.client import x402_get response = x402_get( url="https://apexrunner.ai/signals/cross-asset-contagion", private_key=os.environ["EVM_PRIVATE_KEY"] ) print(response.json()) ``` ```markdown ## Pricing **$25.00/call** — standard price Early adopters automatically receive 30% off ($17.50/call) until 2026-09-21. Discount tiers apply automatically based on wallet call history: - Early Adopter (0–9 calls): 30% off - Engaged (10–49 calls): 15% off - Loyal (50–199 calls): 15% permanent - VIP (200+ calls): 20% permanent ``` ### Technical Analysis The skill requires direct access to `EVM_PRIVATE_KEY` and passes that raw private key to the `x402_get` client. The documented operation automatically authorizes a paid request costing up to $25 per invocation. No explicit user confirmation, per-transaction spending limit, cumulative budget, recipient allowlist, chain validation, transaction preview, rate limit, or replay protection is specified by the skill. A private key provides signing authority over the associated wallet and is substantially more privileged than the read-only market-signal operation presented to the user. Supplying it directly to a third-party client libra ...[truncated 1633 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user confirmation before every paid request and display the exact asset, amount, chain, recipient, endpoint, and cumulative session spend. 2. Enforce hard per-call, per-session, and daily spending limits independently of values supplied by the remote server. 3. Use a dedicated, low-balance wallet solely for x402 payments rather than a general-purpose wallet. 4. Replace raw private-key access with a scoped signer, delegated session key, or wallet service that restricts permitted recipients, chains, assets, methods, and amounts. 5. Keep signing operations isolated from the agent and external response-processing code. The agent should receive only an approval interface, not the private key itself. 6. Validate that payments occur only on Base mainnet, use USDC, target an explicitly allowlisted recipient, and do not exceed the user-approved amount. 7. Add rate limiting, duplicate-request detection, replay protection, timeout handling, and a circuit breaker for repeated or anomalous charges. 8. Pin the x402 client to a reviewed version with integrity verification, audit its secret-handling behavior, and ensure it never logs, persists, or transmits the raw private key. 9. Record payment attempts and outcomes in a redacted audit log without including private keys, signatures reusable outside the intended transaction, or other wallet secrets.