Ntriq X402 Code Review Batch

PassAudited by ClawScan on May 10, 2026.

Overview

This is a disclosed paid remote code-review API; the main things to watch are the $15 USDC charge and sending code snippets to a third-party service.

This skill appears coherent and instruction-only, but before using it you should confirm that you want to pay $15 USDC and that the code snippets you send are safe to share with the listed provider.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill may spend $15 USDC for each paid call.

Why it was flagged

The skill requires an x402 payment header and discloses a $15 USDC charge; this is purpose-aligned but gives the invocation financial impact.

Skill content
X-PAYMENT: <x402-payment-header> ... Price: $15.00 USDC flat ... Network: Base mainnet (EIP-3009 gasless)
Recommendation

Only invoke it when you intend to pay, and use wallet/payment controls or explicit confirmation for each purchase.

What this means

Private source code or embedded secrets could leave your environment if included in the submitted snippets.

Why it was flagged

The documented workflow sends user-provided code snippets to an external provider endpoint for review.

Skill content
POST https://x402.ntriq.co.kr/code-review-batch ... "snippets": [ ... ]
Recommendation

Submit only code you are comfortable sharing with this provider, and redact secrets before use.

What this means

A user might overestimate how locally or privately the submitted code is processed.

Why it was flagged

The skill also documents a remote HTTPS API call, so the 'local inference' wording could be misunderstood as meaning local to the user's machine rather than provider-hosted processing.

Skill content
Review up to 500 code snippets in a single call. Flat $15.00 USDC. 100% local inference on Mac Mini.
Recommendation

Treat this as a third-party remote service unless the provider clearly documents privacy, retention, and where inference actually runs.