T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:132
- Finding
- Autonomous Cryptocurrency Payments Without Human Approval## Vulnerability Details **File Location**: `SKILL.md`, lines 132-137 **Vulnerability Type**: Autonomous financial authorization exceeding least privilege **Risk Level**: High ```bash # Agent can pay directly without human approval export RENDERFUL_X402_WALLET="your_agent_wallet" export RENDERFUL_PREFER_X402="true" ``` ### Technical Analysis The Skill explicitly instructs an Agent to configure a cryptocurrency wallet and enables x402 payments without human approval. Autonomous payment authority is not the minimum privilege necessary to submit image or video generation requests. No controls are specified for transaction value, cumulative spending, recipient validation, supported networks, credential scope, or per-transaction confirmation. The required format of `RENDERFUL_X402_WALLET` is also undocumented, making it unclear whether it contains a public address or sensitive signing credentials. Although the audited file does not itself contain a wallet secret or executable payment implementation, following these instructions could grant an Agent financial authority with insufficient safeguards. ### Attack Path 1. A user asks the Agent to generate an image or video. 2. The Agent follows the Skill and configures `RENDERFUL_X402_WALLET`. 3. The Agent enables `RENDERFUL_PREFER_X402`, preferring the autonomous payment flow. 4. The generation service returns an HTTP 402 payment requirement. 5. The Agent authorizes a cryptocurrency payment without first showing the user the asset, amount, network, recipient, or cumulative cost. 6. Repeated or unexpectedly expensive requests may cause additional irreversible wallet spending. Exploitation depends on the external service and Agent runtime implementing the described x402 payment flow. The audit found no local payment implementation, so it cannot establish the exact wallet credential type or transaction limits. ### Impact Assessment The affected privilege is authority to spen ...[truncated 652 chars]
- Remediation
- ## Remediation Suggestions - Remove the instruction that the Agent may pay without human approval. - Require explicit, transaction-specific user authorization before every payment. - Before requesting approval, display the exact amount, asset, blockchain network, recipient, service description, and applicable fees. - Enforce hard limits for each transaction, each session, and cumulative daily spending. - Use a dedicated, low-balance wallet rather than a user's primary wallet. - Restrict payment credentials to the Renderful service and supported networks wherever the wallet implementation permits it. - Never request, store, log, or transmit seed phrases or raw private keys. - Clearly document whether `RENDERFUL_X402_WALLET` expects a public address, a scoped payment token, or another credential type. - Reject transactions whose destination, network, asset, or amount differs from the values the user approved. - Maintain an auditable payment record and provide a reliable way to disable autonomous payment configuration.