Regime

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:41 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a legitimate paid market-signal lookup, but it requires a raw crypto wallet private key for automatic paid calls without enough spending or key-safety controls.

Only install this with a dedicated low-balance wallet, not a primary wallet. Confirm the expected x402 client source/version, Base USDC payment recipient, and per-call amount before use, and set external spend limits or confirmations where possible to prevent repeated paid calls.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:6

Finding

Raw EVM Private Key Exposed to an Automatically Paying Third-Party Client

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6–36
Vulnerability Type: Sensitive credential handling and unrestricted automatic payment authorization
Risk Level: High

Vulnerable Code

yaml

metadata:
  openclaw:
    requires:
      env:
        - EVM_PRIVATE_KEY
    primaryEnv: EVM_PRIVATE_KEY
    homepage: https://apexrunner.ai/signals/regime
    emoji: "🗺️"

markdown

The x402 client handles payment authorisation automatically. No API key, no account, no subscription required — just an EVM wallet with USDC on Base mainnet.

python

# Example using the x402-python client
from x402.client import x402_get

response = x402_get(
    url="https://apexrunner.ai/signals/regime",
    private_key=os.environ["EVM_PRIVATE_KEY"]
)
print(response.json())

Technical Analysis

The skill requires a raw EVM private key and passes it directly to the x402 client, which automatically authorizes a paid request. An EVM private key is a bearer credential capable of signing transactions for its associated wallet. Giving application code direct access to that key therefore grants substantially more authority than is required merely to retrieve a market-regime classification.

The documentation does not specify a pinned or verified client version, an isolated signing mechanism, a transaction preview, recipient and chain validation, or per-call and cumulative spending controls. This creates a least-privilege and supply-chain exposure: a compromised, substituted, or unexpectedly behaving client could access the key or request unintended signatures.

The reviewed file does not establish that the private key is transmitted to apexrunner.ai; private-key exfiltration by that service is therefore not asserted. The confirmed weakness is the unsafe trust boundary created by supplying an unrestricted wallet key to third-party client code that performs automatic payments.

Atta

...[truncated 1299 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace direct private-key access with an isolated signer, hardware wallet, delegated session key, or payment mechanism that never exposes the raw key to application code.
2. Use a dedicated wallet containing only the minimum funds required for this skill. Do not reuse a primary wallet or a key controlling unrelated assets.
3. Enforce strict per-request, daily, and cumulative spending limits outside the skill and client process.
4. Validate the expected chain, token, recipient, contract, and exact payment amount before signing.
5. Require explicit user confirmation before the first payment and whenever the amount, recipient, or network differs from an approved policy.
6. Pin the x402 dependency to a reviewed version, verify package provenance and integrity, and document the trusted installation source.
7. Run the payment client in a restricted environment with minimal filesystem, network, and environment-variable access.
8. Add rate limits and replay protection to prevent accidental loops or repeated paid calls.
9. Document wallet-rotation and incident-response procedures in case the key or dependency is compromised.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to use x402 with an on-chain private key and states that payment authorization is handled automatically, but it does not clearly warn that each invocation can spend wallet funds. In a tool likely to be called by an autonomous agent, this omission can lead to unreviewed micropayments, unexpected spending, and repeated fund drain through normal use or prompt-induced overuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.