T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:8
- Finding
- Unrestricted Wallet Private Key Use for Automatic Paid Requests<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 8–48 **Vulnerability Type**: Excessive secret access and insufficient payment authorization controls **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: openclaw: requires: env: - EVM_PRIVATE_KEY primaryEnv: EVM_PRIVATE_KEY homepage: https://apexrunner.ai/signals/portfolio-heat ``` ```markdown The x402 client handles payment authorisation automatically. No API key, no account, no subscription required — just an EVM wallet with USDC on Base mainnet. ``` ```python # Example using the x402-python client from x402.client import x402_get response = x402_get( url="https://apexrunner.ai/signals/portfolio-heat", private_key=os.environ["EVM_PRIVATE_KEY"] ) print(response.json()) ``` ```markdown ## Pricing **$1.00/call** — standard price ``` ### Technical Analysis The skill requires the agent's execution environment to expose a reusable EVM wallet private key. It then passes that key to an x402 client that automatically authorizes a paid request to an external service. Although the reviewed file does not demonstrate private-key exfiltration, this design grants the skill access to signing authority broader than the read-only portfolio signal requires. The instructions specify a per-call price but provide no explicit per-request confirmation, cumulative spending ceiling, invocation-rate limit, destination allowlist enforced outside the skill, or requirement to use a dedicated low-balance wallet. Consequently, unintended, duplicated, or repeatedly triggered invocations can authorize real USDC expenditure. Directly exposing the private key through an environment variable also expands the consequences of any compromise in the agent process or imported client library. ### Attack Path 1. A user configures `EVM_PRIVATE_KEY` with an EVM wallet holding USDC on Base. 2. The agent loads the skill and obtains access to that environment variable. 3. The agen ...[truncated 1136 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Use a dedicated wallet containing only the minimum funds needed for this skill; never use a primary or broadly funded wallet. 2. Replace direct private-key exposure with a constrained signing service or wallet interface that enforces: - An allowlist for the expected chain, token, recipient, and endpoint. - A strict maximum amount per request. - Daily and cumulative spending limits. - Request-rate limits and replay protection. 3. Require explicit user confirmation before every charge, displaying the exact amount, asset, network, recipient, and endpoint. 4. Disable automatic retries for payment-bearing requests unless each retry is separately authorized or cryptographically proven not to create another charge. 5. Validate the server's payment request against a locally configured maximum rather than trusting pricing information returned by the remote service. 6. Prevent the raw private key from being logged, included in error messages, retained in agent memory, or exposed to unrelated tools and subprocesses. 7. Pin and audit the x402 client dependency, because it operates on sensitive signing material. 8. Document revocation and incident-response procedures, including wallet rotation and immediate fund migration if key exposure is suspected. ]]>