Mean Reversion Scan

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:47 AM UTC
• Version: 1.0.0

Overview

This skill is a real paid crypto-signal integration, but it asks for a full wallet private key and can authorize paid calls automatically without enough spending safeguards.

Review this carefully before installing. Use only a dedicated low-balance wallet, not a primary wallet, and assume each invocation can spend USDC on Base. Verify the x402 client, recipient, network, amount, retries, and total spend before allowing automated use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:7

Finding

Automatic Paid Requests Use a Raw EVM Private Key Without Explicit Spending Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7–8, 23–34, and 49
Vulnerability Type: Sensitive wallet credential exposure and uncontrolled payment authorization
Risk Level: Medium

Vulnerable Code

yaml

requires:
  env:
    - EVM_PRIVATE_KEY

markdown

The agent makes an x402-authenticated GET request to:

`https://apexrunner.ai/signals/mean-reversion-scan`

The x402 client handles payment authorisation automatically. No API key, no account, no subscription required — just an EVM wallet with USDC on Base mainnet.

```python
# Example using the x402-python client
from x402.client import x402_get

response = x402_get(
    url="https://apexrunner.ai/signals/mean-reversion-scan",
    private_key=os.environ["EVM_PRIVATE_KEY"]
)
print(response.json())

text

```markdown
**$0.75/call** — standard price

Technical Analysis

The Skill requires access to an EVM wallet private key and passes that credential directly to an x402 client that automatically authorizes paid requests. A private key grants signing authority over its associated wallet and is substantially more sensitive than a narrowly scoped API token.

Although the per-call price is disclosed, the Skill does not document or enforce:

• Explicit user approval before each payment.
• A maximum payment amount per request.
• A cumulative session or daily spending limit.
• Validation of the payment recipient, chain, token, and authorization amount before signing.
• Use of a dedicated, low-balance wallet.
• A pinned and audited version of the x402 client.
• Controls preventing the private key from being logged or exposed to unrelated process components.

The reviewed file does not prove that apexrunner.ai receives the private key, and no private-key exfiltration by the endpoint is asserted. The risk arises from exposing full wallet signing authority to the local client process and allowing that clie ...[truncated 1488 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace direct use of a general-purpose wallet private key with a dedicated payment wallet containing only the minimum required balance.
2. Prefer a scoped signer, delegated authorization mechanism, or isolated signing service that cannot perform arbitrary wallet transactions.
3. Require explicit user confirmation before every payment, displaying the recipient, network, token, amount, and endpoint.
4. Enforce strict per-request, per-session, and daily spending limits independently of values supplied by the remote service.
5. Validate that every authorization targets the expected Base mainnet chain, approved USDC contract, intended recipient, and maximum advertised amount.
6. Prevent automatic retries from creating additional payments unless the user approves them.
7. Pin the x402 dependency to a specific reviewed version and verify package integrity through hashes or lockfiles.
8. Ensure the private key is never logged, serialized, included in error reports, or exposed to unrelated plugins and subprocesses.
9. Document wallet rotation and revocation procedures in case the execution environment or dependency is compromised.
10. Add clear warnings that repeated Skill invocation incurs charges and expose the accumulated cost to the user before further calls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly requires an EVM private key and states that the x402 client will handle payment authorization automatically, but it does not clearly warn users that supplying this key can authorize paid requests against their wallet. In a trading-related skill, this omission is materially risky because users may treat the key as a simple API credential rather than a payment-capable secret, leading to unintended wallet spending.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.