Ntriq X402 Content Generate

PassAudited by ClawScan on May 10, 2026.

Overview

This is a simple paid content-generation API skill; the main things to notice are that each call spends USDC and sends your prompt to an external service.

This skill appears benign and purpose-aligned, with no local code or install step. Before using it, be aware that calls are paid in USDC and that your prompt is sent to the provider's remote endpoint. Use spending limits or confirmation prompts if your agent can invoke paid skills automatically.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

If invoked repeatedly or unintentionally, the skill could spend small amounts of USDC.

Why it was flagged

The skill requires a payment authorization header and charges USDC per API call. This is disclosed and purpose-aligned for a paid x402 service, but it crosses a financial authorization boundary.

Skill content

X-PAYMENT: <x402-payment-header> ... Price: $0.02 USDC per call ... Network: Base mainnet (EIP-3009 gasless)

Recommendation

Use wallet/payment controls, confirm paid calls before use, and consider spending limits for agent-accessible x402 payments.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Sensitive or confidential prompt content could be shared with the external service if the user includes it.

Why it was flagged

The user's prompt is sent to an external provider endpoint. This is expected for the advertised content-generation API, but users should understand the data leaves their agent environment.

Skill content

POST https://x402.ntriq.co.kr/content-generate ... "prompt": "benefits of standing desks for office workers"

Recommendation

Avoid sending confidential information unless you trust the provider and its privacy practices.

Note

ASI09: Human-Agent Trust Exploitation

What this means

Users may overestimate how private or local the processing is.

Why it was flagged

The phrase 'local inference' could be misunderstood as processing on the user's own machine, while the documented usage sends a request to a remote HTTPS endpoint. It may mean provider-hosted local hardware, but the boundary is not fully explicit.

Skill content

100% local inference on Mac Mini ... POST https://x402.ntriq.co.kr/content-generate

Recommendation

Treat this as a remote provider call unless the publisher clearly documents otherwise.