T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:303- Finding
Overbroad Wildcard Network Egress Permission
- Content
View full analysis
- Remediation
View remediation
Security audit
Claude AI Trading Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for Elfa API access, but it needs Review because its x402 examples can spend real USDC without a clear per-call consent gate.
Review before installing if you plan to use x402. Prefer API-key mode via ELFA_API_KEY, allow only api.elfa.ai for network access, never paste or hardcode wallet private keys, and only run x402 requests with an explicit spend limit or low-balance wallet after confirming the expected cost.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:182- Finding
Private-Key Hardcoding Pattern in x402 Example
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Do not attempt any authenticated API calls without a key or x402 setup. Wait for the user. 3. **Credential safety:** - Always read the API key from the `ELFA_API_KEY` environment variable, never ask the user to paste it into the conversation. - Never log or expose the full API key in outputs — mask it when displaying curl commands. - If a user does paste a key in chat, warn them to rotate it and set it as an env var instead.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Making the call:
bash curl -s -H "x-elfa-api-key: $ELFA_API_KEY" "https://api.elfa.ai/v2/aggregations/trending-tokens?timeWindow=24h&pageSize=10"Step 2b: Making live API calls (x402 keyless mode)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill documents x402 payment flows and even recommends wrappers that automatically retry paid requests, but it does not require an explicit user confirmation that real USDC may be spent. In an agent setting, this creates a meaningful risk of unintended financial transactions if the model follows the skill for a live request without making the cost and spending consequence unmistakably clear.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md libraries. The agent never handles, stores, or transmits private keys. - The user's wallet private key is used only locally by the x402 library to sign EIP-712 typed data authorizing a specific USDC amount for a specific request. - Never ask the user to share their wallet private key or seed phrase in the conversation. - When generating x402 code examples, use `"0xYOUR_PRIVATE_KEY"` as a placeholder and advise the user to load it from an environment variable (e.g., `process.env.PRIVATE_KEY`).
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
This example initiates an x402 request flow that is designed to obtain payment requirements and proceed toward a paid request, yet it is presented as a routine call without a strong financial-risk warning. In an agent context, showing live commands that can trigger a spend path increases the chance of unintended paid interactions with an external service.
- Content
bash # Step 1: Send request without payment — get 402 with payment requirements curl -s https://api.elfa.ai/x402/v2/aggregations/trending-tokens?timeWindow=24h # Step 2: After signing the payment payload with your wallet, resend with X-PAYMENT header curl -s -H "X-PAYMENT: <base64-encoded-payment-payload>" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
This example shows resending the request with an X-PAYMENT header, which represents the billable step of the x402 flow. Without an explicit requirement for informed user consent, an agent could reproduce or encourage a real paid request that spends USDC.
- Content
Step 2: After signing the payment payload with your wallet, resend with X-PAYMENT header
curl -s -H "X-PAYMENT: "
"https://api.elfa.ai/x402/v2/aggregations/trending-tokens?timeWindow=24h"text **Recommended: use the `@x402/fetch` library** which handles payment automatically:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The x402Fetch wrapper is described as automatically handling payment on 402 responses, which materially lowers friction for spending real funds. In an autonomous-agent environment, automatic payment handling without a mandatory user-approval step is risky because a normal-looking fetch can silently become a paid transaction.
- Content
// Use x402Fetch exactly like regular fetch — payment is handled automatically on 402 responses const response = await x402Fetch( "https://api.elfa.ai/x402/v2/aggregations/trending-tokens?timeWindow=24h"); const data = await response.json();
text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
x402 with the Chat endpoint (POST):
javascript const response = await x402Fetch( "https://api.elfa.ai/x402/v2/chat", { method: "POST",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
This paid chat example uses x402Fetch for a POST call, meaning message contents are sent externally and payment may be handled automatically. The combination of data transmission and implicit billing is dangerous in an agent workflow if the user is not clearly warned that both sensitive prompts and real funds may be involved.
- Content
javascript const response = await x402Fetch( "https://api.elfa.ai/x402/v2/chat", { method: "POST", headers: { "Content-Type": "application/json" },
Static analysis
No suspicious patterns detected.