Security audit
Security checks for vulnerabilities and agentic risk
The web-data service fits its description, but its setup prints the wallet’s private key before asking you to fund that wallet.
Review the wallet setup before use. Remove private-key logging and use protected key storage; replace any wallet whose key has already appeared in logs before funding it. Use a dedicated wallet with a small balance and a spending limit. Treat submitted URLs, queries, and documents as information shared with ClawFetch.
Wallet creation could support a payment workflow, but this chunk only generates and prints wallet credentials, including the private key. That standalone behavior is materially different from the declared web intelligence service and does not demonstrate an X402 payment implementation. No network transmission or external exfiltration is shown.
The setup explicitly prints wallet.privateKey, potentially exposing it through captured stdout, agent transcripts, monitoring, or shared logs. Anyone obtaining that key can control the wallet and steal funds subsequently deposited into it; the instruction to save the key securely does not prevent the initial disclosure.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
});
// Now use it like normal fetch — payments happen automatically!
const response = await x402Fetch('https://api.clawfetch.ai/render', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ url: 'https://example.com' }),
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
});
// Now use it like normal fetch — payments happen automatically!
const response = await x402Fetch('https://api.clawfetch.ai/render', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ url: 'https://example.com' }),
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 1. Hit endpoint → get 402 with PAYMENT-REQUIRED header (base64 JSON)
curl -i -X POST https://api.clawfetch.ai/fetch \
-H "Content-Type: application/json" \
-d '{"url": "https://example.com"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 1. Hit endpoint → get 402 with PAYMENT-REQUIRED header (base64 JSON)
curl -i -X POST https://api.clawfetch.ai/fetch \
-H "Content-Type: application/json" \
-d '{"url": "https://example.com"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 4. Base64-encode the signed payload
# 5. Resend with PAYMENT-SIGNATURE header
curl -X POST https://api.clawfetch.ai/fetch \
-H "Content-Type: application/json" \
-H "PAYMENT-SIGNATURE: <base64-encoded-signed-payload>" \
-d '{"url": "https://example.com"}'
These instructions direct the agent to route web-fetching and research tasks through ClawFetch, transmitting target URLs and research queries to an external service. The skill does not warn that these inputs may reveal confidential topics or sensitive URL parameters, or instruct the agent to exclude sensitive data.