Security audit
Security checks for vulnerabilities and agentic risk
The skill is a simple Obul proxy guide, but its open-ended proxying with an API key and automatic payments needs review before use.
Install only if you intend agents to use your Obul API key for x402 proxy calls. Treat each proxied request as potentially billable, approve the upstream URL and expected cost before use, avoid sending sensitive data through unknown upstream services, and do not use this as a general-purpose proxy without additional controls.
The activation text is broad enough to match generic requests about proxies or direct API calls, which can cause the skill to be invoked outside the narrow x402/Obul use case. In a skill that forwards requests and automatically handles payment negotiation, over-broad routing increases the chance of unintended external requests, misuse of the Obul API key, or accidental paid actions.
Stating that the skill can 'Proxy any upstream request' grants effectively open-ended scope to a network-capable skill. In context, this is more dangerous because the proxy can reach arbitrary upstreams while attaching a privileged API key and automatically negotiating payments, enabling unintended SSRF-like behavior, exfiltration pathways, or unapproved spending.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## Error Handling
| Error | Cause | Solution |
|-----------------------------|---------------------------------------|-----------------------------------------------------------------------------------------------|
| `401 Unauthorized` | Missing or invalid API key | Verify `OBUL_API_KEY` is set and valid. |
| `402 Payment Required` | Upstream requires payment | Ensure your Obul account has sufficient balance. |
No suspicious patterns detected.