Regime Confluence

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:41 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent paid trading-signal integration, but it asks agents to use a full EVM private key for automatic wallet payments without clear spending limits or confirmation controls.

Review this before installing if the wallet contains meaningful funds. Use only a dedicated low-balance payment wallet, set external spending/rate limits where possible, and avoid unattended loops unless the calling agent previews and confirms payment details for each request.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:23

Finding

Unbounded Automatic Wallet Payment Authorization

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23–35
Vulnerability Type: Automatic payment authorization using a full EVM private key without documented transaction constraints
Risk Level: Medium

Evidence

markdown

## How to Use
The agent makes an x402-authenticated GET request to:

https://apexrunner.ai/signals/regime-confluence

text

The x402 client handles payment authorisation automatically. No API key, no account, no subscription required — just an EVM wallet with USDC on Base mainnet.

```python
# Example using the x402-python client
from x402.client import x402_get

response = x402_get(
    url="https://apexrunner.ai/signals/regime-confluence",
    private_key=os.environ["EVM_PRIVATE_KEY"]
)
print(response.json())

text

### Technical Analysis

The Skill instructs the agent to provide an unrestricted EVM private key to a third-party x402 client and states that payment authorization occurs automatically. Although the advertised price is documented as `$0.10/call`, the example does not enforce that price locally or define restrictions for the payment recipient, chain, token, per-call amount, cumulative spending, or request frequency.

A private key grants signing authority over the corresponding wallet rather than authority limited to this individual signal purchase. This violates least-authority principles for payment operations. The Skill also does not require transaction previews or explicit user approval before a payment is signed.

No evidence shows that the private key is transmitted to the remote signal service. The risk arises from exposing full wallet signing authority to the client workflow and relying on remote payment requirements without documented local limits.

### Attack Path

1. The agent reads `EVM_PRIVATE_KEY` from its environment.
2. The agent passes the unrestricted key to `x402_get`.
3. The remote endpoint supplies an x402 payment requirement.
...[truncated 1046 chars]

Remediation

View remediation

Remediation Suggestions

1. Use a dedicated payment wallet containing only the minimum funds required for expected calls; never use a primary or treasury wallet.
2. Replace unrestricted private-key access with a scoped signer, smart-account session key, allowance-based mechanism, or payment proxy restricted to this service.
3. Validate the chain ID, token contract, payment recipient, per-call price, and maximum cumulative spend locally before signing.
4. Reject payment requirements exceeding the documented price and fail closed if any payment field is absent or unexpected.
5. Add per-request confirmation for interactive use and configurable daily and session spending limits for automation.
6. Apply request-rate and retry limits to prevent loops from generating repeated paid calls.
7. Pin and audit the x402 client dependency, verify its private-key handling, and ensure sensitive key material is never logged or transmitted.
8. Clearly document that invoking the Skill causes a financial transaction and display the exact payment details before authorization.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs the agent to use an x402-authenticated request with the user's EVM private key, and says payment authorization is handled automatically, but it does not present a prominent user warning that invoking the skill can spend funds from the user's wallet. This creates a real risk of unintended paid transactions because an agent or user may treat the call like an ordinary API request rather than a wallet-authorized purchase.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.