Ntriq X402 Alt Text Batch

PassAudited by ClawScan on May 10, 2026.

Overview

This is a straightforward paid external alt-text API skill, but users should know it sends image URLs and context to the provider and may spend $3 USDC per call.

Before installing or using this skill, confirm you are comfortable paying $3 USDC per batch and sending the selected image URLs and context to x402.ntriq.co.kr. Do not assume the images remain on your own device just because the skill mentions local inference.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Each successful invocation may spend $3.00 USDC.

Why it was flagged

The skill uses an x402 payment header to authorize a crypto payment, but the amount and payment protocol are clearly disclosed and aligned with the service.

Skill content

X-PAYMENT: <x402-payment-header> ... Price: $3.00 USDC flat

Recommendation

Only invoke the skill when you intend to pay for the batch, and use wallet or platform spend limits where available.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

The provider may be able to access the submitted image URLs and contextual text.

Why it was flagged

The external provider receives the image URLs and optional context needed to generate alt text. This is expected for the stated purpose, but it is still a third-party data flow.

Skill content

POST https://x402.ntriq.co.kr/alt-text-batch ... "images": ["https://example.com/product1.jpg"], "context": "e-commerce product catalog"

Recommendation

Use this only with images and context you are comfortable sending to the provider, and avoid private or access-controlled image URLs unless appropriate.

Info

#ASI09: Human-Agent Trust Exploitation

What this means

A user might incorrectly assume their images stay on their own device.

Why it was flagged

The skill clearly uses a remote API endpoint, while the 'local inference' wording could be misunderstood as local to the user rather than local to the provider’s infrastructure.

Skill content

POST https://x402.ntriq.co.kr/alt-text-batch ... 100% local inference on Mac Mini.

Recommendation

Treat this as an external API service unless the provider separately documents exactly where and how images are processed.