other
Warning
- Location
- SKILL.md:33
- Finding
- Paid task execution lacks explicit user authorization## Vulnerability Details **File Location**: `SKILL.md`, lines 33–55 **Vulnerability Type**: Unauthorized payment **Risk Level**: Medium **Relevant snippet**: ```markdown 2. **Quote** — `POST https://api.x-402.online/v1/agent/quote` (free, no payment, no provider called). Returns the workflow it would run, the estimated cost, the price, the expected latency and the known limitations. 3. **Decide** — if the quote does not match the task, stop here. Nothing has been spent. 4. **Execute** — `POST https://api.x-402.online/v1/agent/task`. ```json { "objective": "summarise this page in three factual points", "source": "https://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol", "requirements": { "verification": true } } ``` `budget` is optional: the price is fixed, and if you pass a cap below it the request is refused before any payment challenge. ## Payment x402. Call the endpoint, receive `HTTP 402` with the payment requirements, sign, retry with the payment header. **0.012800 USDC** per task, whatever the number of internal steps. USDC on Base or Solana. No account, no API key, no signup. ``` ### Technical Analysis The documented workflow directs the Agent to inspect a free quote, decide whether it matches the task, and then execute the paid endpoint. Execution requires signing an x402 payment challenge and retrying the request with the payment header. The instructions do not require explicit user approval after presenting the exact quote and before signing the payment. Consequently, a general request for a composed or externally orchestrated task can be interpreted as sufficient authority to spend funds. A quote check limits unexpected pricing but does not establish that the user knowingly authorized the transaction. The dangerous operation is signing and transmitting a payment backed by a funded wallet. This crosses the boundary between authorization to perform a task and authorization to transfer the user’s assets. The issue is reachable w ...[truncated 1563 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit, transaction-specific user approval after obtaining the quote and before signing any payment challenge. 2. Present the objective, exact amount, currency, blockchain network, recipient or payment destination, and known limitations in the confirmation prompt. 3. Treat silence, ambiguous approval, or general task authorization as refusal to spend funds. 4. Require the approved quote identifier, amount, and destination to match the payment challenge before signing. 5. Enforce a user-configured per-task and cumulative spending cap; do not rely solely on the optional `budget` field. 6. Disable automatic payment retries. Any changed amount, network, recipient, objective, or expired quote should require renewed approval. 7. Prefer a dry-run or quote-only default unless the user explicitly requests paid execution. 8. Record transaction details and the corresponding approval for auditability without logging wallet secrets or signing material.