ClawHub
Back to skill

Security audit

x402-api-builder

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed template for running a paid API and MCP wrapper, with one credential-routing footgun users should configure carefully.

Install only if you are comfortable running a public FastAPI service. Before production use, set your own PAYMENT_WALLET and KEY_SECRET, keep api_keys.json out of version control, configure X402_BASE only to your trusted HTTPS API host, and avoid sharing an environment where another party can modify these variables.

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Tainted flow: 'req' from os.environ.get (line 13, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
88% confidence
Finding

The request URL is derived from the X402_BASE environment variable and then used directly in urllib.request.urlopen, so whoever controls the runtime environment can redirect this tool's outbound request to an arbitrary host. Because the code also attaches the x-api-key header to every request, a misconfigured or attacker-controlled BASE can cause credential disclosure or SSRF-like behavior from the MCP server process.

Content

Scanner excerpt · scripts/mcp_server.py (reported line 14)May include surrounding context.

python
url = BASE + path
    if params: url += "?" + "&".join(f"{k}={v}" for k, v in params.items())
    req = urllib.request.Request(url, headers={"x-api-key": KEY})
    with urllib.request.urlopen(req, timeout=20) as r:
        return json.loads(r.read().decode())

@mcp.tool()

Static analysis

No suspicious patterns detected.