ClawHub
Back to skill

Security audit

liquid-gas-sponsor

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and not deceptive, but it guides agents through real wallet payments, signed on-chain submissions, and possible EIP-7702 redelegation without strong upfront user-confirmation guardrails.

Install only if you understand that this skill is for real Base wallet transactions. Before any use, require manual review of the chain ID, target contract, calldata purpose, USDC fee, payment recipient, signed typed data, and any EIP-7702 delegation or redelegation target. Do not let an agent auto-pay or auto-sign these steps without approval.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (12)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: liquid-gas-sponsor
description: Send any transaction on Base with a wallet that holds USDC but no ETH. Pay the gas per operation in USDC over x402 (from $0.03) through an ERC-4337 paymaster; one endpoint for smart-wallet SDKs and plain wallets. No account, no API key.
homepage: "https://api.liquidagent.ai/v1/gas"

metadata:
  openclaw:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
---
name: liquid-gas-sponsor
description: Send any transaction on Base with a wallet that holds USDC but no ETH. Pay the gas per operation in USDC over x402 (from $0.03) through an ERC-4337 paymaster; one endpoint for smart-wallet SDKs and plain wallets. No account, no API key.
homepage: "https://api.liquidagent.ai/v1/gas"

metadata:
  openclaw:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
---
name: liquid-gas-sponsor
description: Send any transaction on Base with a wallet that holds USDC but no ETH. Pay the gas per operation in USDC over x402 (from $0.03) through an ERC-4337 paymaster; one endpoint for smart-wallet SDKs and plain wallets. No account, no API key.
homepage: "https://api.liquidagent.ai/v1/gas"

metadata:
  openclaw:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md
---
name: liquid-gas-sponsor
description: Send any transaction on Base with a wallet that holds USDC but no ETH. Pay the gas per operation in USDC over x402 (from $0.03) through an ERC-4337 paymaster; one endpoint for smart-wallet SDKs and plain wallets. No account, no API key.
homepage: "https://api.liquidagent.ai/v1/gas"

metadata:
  openclaw:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md
---
name: liquid-gas-sponsor
description: Send any transaction on Base with a wallet that holds USDC but no ETH. Pay the gas per operation in USDC over x402 (from $0.03) through an ERC-4337 paymaster; one endpoint for smart-wallet SDKs and plain wallets. No account, no API key.
homepage: "https://api.liquidagent.ai/v1/gas"

metadata:
  openclaw:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
---
name: liquid-gas-sponsor
description: Send any transaction on Base with a wallet that holds USDC but no ETH. Pay the gas per operation in USDC over x402 (from $0.03) through an ERC-4337 paymaster; one endpoint for smart-wallet SDKs and plain wallets. No account, no API key.
homepage: "https://api.liquidagent.ai/v1/gas"

metadata:
  openclaw:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
---
name: liquid-gas-sponsor
description: Send any transaction on Base with a wallet that holds USDC but no ETH. Pay the gas per operation in USDC over x402 (from $0.03) through an ERC-4337 paymaster; one endpoint for smart-wallet SDKs and plain wallets. No account, no API key.
homepage: "https://api.liquidagent.ai/v1/gas"

metadata:
  openclaw:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill prominently instructs users to pay a 402 quote, sign returned data, and submit a transaction, but it does not lead with a clear warning that these actions authorize irreversible on-chain effects and USDC spending. In an agent-skill context, that omission is dangerous because automated consumers may follow the workflow mechanically and expose funds without explicit user confirmation or transaction review.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

bash
# 1. Quote. No payment header -> HTTP 402 with the exact USDC price for THIS operation (valid 120 s).
curl -s -X POST https://api.liquidagent.ai/v1/gas -H 'content-type: application/json' \
  -d '{"sender":"0xYourEOA","calls":[{"to":"0x…","data":"0x…","value":"0"}]}'

# 2. Pay it. Any x402 client (agentcash, x402-fetch) repeats the call with X-PAYMENT and receives:

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This duplicate finding corresponds to sending a signed operation and optional EIP-7702 authorization back to the sponsor. In an agent context, forwarding signed executable payloads to an external service without strong user-warning and verification guidance increases the chance of unintended asset movement or wallet reconfiguration.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

- sign typedData with the sender's key (eth_signTypedData_v4) -> put the 65-byte signature in userOperation.signature

- if "authorization" is present (first time only): sign it too (EIP-7702; viem: account.signAuthorization)

- POST both back to the SAME URL before validUntil:

curl -s -X POST https://api.liquidagent.ai/v1/gas -H 'content-type: application/json'
-d '{"userOperation":{...with signature...},"authorization":{...signed, optional...}}'

-> { "txHash": "0x…", "success": true, "actualGasCostEth": "…" } (no further charge)

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This duplicate finding corresponds to sending a signed operation and optional EIP-7702 authorization back to the sponsor. In an agent context, forwarding signed executable payloads to an external service without strong user-warning and verification guidance increases the chance of unintended asset movement or wallet reconfiguration.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

- sign typedData with the sender's key (eth_signTypedData_v4) -> put the 65-byte signature in userOperation.signature

- if "authorization" is present (first time only): sign it too (EIP-7702; viem: account.signAuthorization)

- POST both back to the SAME URL before validUntil:

curl -s -X POST https://api.liquidagent.ai/v1/gas -H 'content-type: application/json'
-d '{"userOperation":{...with signature...},"authorization":{...signed, optional...}}'

-> { "txHash": "0x…", "success": true, "actualGasCostEth": "…" } (no further charge)

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation describes setting "redelegate": true to re-point an EOA's EIP-7702 delegation to a different implementation, but the warning about changed wallet control semantics is not sufficiently prominent. Redelegation changes how the wallet executes transactions and can affect compatibility, security assumptions, and authorization flow, so presenting it as a simple reversible step can understate real risk.

Content

No source excerpt is available for this finding.