ClawHub
Back to skill

Security audit

x402-api-builder

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed template for running a paid API and MCP wrapper, with one credential-routing footgun users should configure carefully.

Install only if you are comfortable running a public FastAPI service. Before production use, set your own PAYMENT_WALLET and KEY_SECRET, keep api_keys.json out of version control, configure X402_BASE only to your trusted HTTPS API host, and avoid sharing an environment where another party can modify these variables.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Tainted flow: 'req' from os.environ.get (line 13, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
url = BASE + path
    if params: url += "?" + "&".join(f"{k}={v}" for k, v in params.items())
    req = urllib.request.Request(url, headers={"x-api-key": KEY})
    with urllib.request.urlopen(req, timeout=20) as r:
        return json.loads(r.read().decode())

@mcp.tool()
Confidence
88% confidence
Finding
The request URL is derived from the X402_BASE environment variable and then used directly in urllib.request.urlopen, so whoever controls the runtime environment can redirect this tool's outbound request to an arbitrary host. Because the code also attaches the x-api-key header to every request, a misconfigured or attacker-controlled BASE can cause credential disclosure or SSRF-like behavior from the MCP server process.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.