Security audit

Neckr0ik X402 Payments

Security checks across malware telemetry and agentic risk

Overview

This payment skill is not clearly malicious, but it presents itself as a real autonomous payment tool while the implementation mostly simulates payments and gives weak guidance for wallet secrets and local records.

Install only for testing or code review. Do not enter a funded wallet private key, and do not rely on this skill for real settlement, account balances, payment enforcement, or production API access until the publisher clearly labels simulation behavior or implements verified payments with safer key handling and spending controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill is advertised as enabling autonomous micropayments, but the payment path only fabricates a receipt and transaction hash locally without performing any blockchain transfer or facilitator interaction. In a payments skill, this is dangerous because downstream agents or operators may believe value was transferred when it was not, leading to fraud, unpaid access attempts, accounting errors, and unsafe automation around financial operations.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The module documentation and CLI usage claim capabilities such as serving payments and wallet-related behavior that are not actually implemented. In a security-sensitive payment skill, misleading operators and agents about available functionality increases the chance of unsafe assumptions, broken controls, and accidental exposure of services under the belief that payment enforcement exists.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The `pay` command is presented as a normal retrieval action but the documentation does not clearly warn that it may sign and submit real blockchain payments to a third-party endpoint. In an autonomous-agent context, that omission can cause unintended asset transfers, especially if an operator assumes the command only fetches data or checks availability.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The private key setup instructions tell users to provide a wallet private key without a strong warning that this is a highly sensitive secret controlling funds. In practice, users may paste live keys into shell history, config stores, logs, or insecure environments, leading to irreversible theft of cryptocurrency assets.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: Payment history is appended to a local file without any notice, consent flow, retention policy, or permission hardening. While the stored data is limited, it includes transaction metadata that may reveal spending patterns, counterparties, and operational activity if the host is shared or the files are collected by other software.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.