Grid Health

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:47 AM UTC
• Version: 1.0.0

Overview

The skill is a paid crypto-trading signal helper, but it asks the agent to use a raw wallet private key for automatic paid requests without clear spending controls.

Install only if you are comfortable making paid on-chain requests from a wallet. Use a dedicated low-balance wallet, avoid primary wallets, monitor charges, and require your agent workflow to confirm each paid call.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:6

Finding

Unconstrained Automatic Payments Using a Raw Wallet Private Key

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6–43
Vulnerability Type: Automatic financial authorization with an unrestricted private key
Risk Level: High

Vulnerable Code

yaml

metadata:
  openclaw:
    requires:
      env:
        - EVM_PRIVATE_KEY
    primaryEnv: EVM_PRIVATE_KEY

markdown

The x402 client handles payment authorisation automatically. No API key, no account, no subscription required — just an EVM wallet with USDC on Base mainnet.

python

# Example using the x402-python client
from x402.client import x402_get

response = x402_get(
    url="https://apexrunner.ai/signals/grid-health",
    private_key=os.environ["EVM_PRIVATE_KEY"]
)
print(response.json())

markdown

## Pricing
**$0.50/call** — standard price

Technical Analysis

The Skill requires a raw EVM private key and passes it to an application-level third-party client that automatically authorizes a paid request. The documented flow does not require explicit user confirmation for each payment and does not prescribe a per-request limit, cumulative spending limit, request-frequency limit, recipient validation, or separation between the payment wallet and the user's primary wallet.

A private key grants signing authority over the associated wallet. Supplying it to a client library therefore exposes substantially more authority than is necessary to retrieve a health-status response. Although the reviewed file does not demonstrate key exfiltration or malicious dependency behavior, a compromised client, unsafe runtime, or uncontrolled repeated invocation could misuse the signing authority or generate unintended charges.

Attack Path

1. The user configures EVM_PRIVATE_KEY for the Skill.
2. The agent invokes x402_get to retrieve the advertised health signal.
3. The client reads the unrestricted private key and automatically signs payment authorization for the request.
4. The invocation occurs without a documented per-payment confirm ...[truncated 958 chars]

Remediation

View remediation

Remediation Suggestions

1. Use a dedicated, low-balance payment wallet instead of a primary wallet or a wallet containing unrelated assets.
2. Replace direct raw-key access with a constrained signer, delegated authorization mechanism, or wallet interface that can enforce transaction policies.
3. Require explicit user confirmation before every paid request, displaying the exact price, asset, network, recipient, and destination endpoint.
4. Enforce hard per-call, per-session, and cumulative daily spending limits independently of instructions supplied by the remote service.
5. Validate that authorization is restricted to the expected USDC contract on Base mainnet and the intended payment recipient.
6. Add request-frequency controls, duplicate-request protection, timeouts, and replay protection.
7. Pin the x402 client to a reviewed version, verify package provenance and integrity, and audit its key-handling and signing behavior.
8. Ensure private keys are never logged, included in exception messages, persisted to files, or returned in model-visible output.
9. Document wallet revocation and incident-response procedures, including immediate fund migration if key exposure is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to make an x402-authenticated request using an EVM private key and explicitly states that payment authorization is handled automatically, but it does not clearly warn that this can spend on-chain funds or that the private key is highly sensitive. In an agent context, this is dangerous because a user or downstream system may supply a wallet key expecting read-only API access, while the call can trigger paid transactions and expose a signing credential to the skill execution path.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.