T09 · Insecure Skill Coding Practices
Error
- Location
scripts/a2a_client.py:185- Finding
Credits Purchases Bypass Spending, Reputation, and Confirmation Controls
- Content
View full analysis
Dict[str, Any]: """ Purchase a skill using credits instead of USDC. Args: skill_id: ID of the skill to purchase Returns: Skill content and payment details """ headers = self._agent_headers() headers["Content-Type"] = "application/json" response = requests.post( f"{self.api_url}/v1/listings/{skill_id}/pay", headers=headers, data=json.dumps({"payment_method": "credits"}) ) response.raise_for_status() return response.json() ``` ### Technical Analysis The `purchase()` method immediately delegates credits purchases to `purchase_with_credits()`. This happens before the listing is retrieved and before the following controls used by the x402 path are applied: - Seller reputation validation - Per-transaction budget validation - Daily budget validation - Human confirmation above the automatic approval threshold The credits purchase method itself does not independently implement any of these controls. This contradicts the documented decision flow, which states that reputation, budget, payment method, and approval should be checked before purchase. ### Attack Path 1. An attacker or low-reputation seller publishes a misleading or malicious listing. 2. The Agent selects the credits payment method, either autonomously or due to user input. 3. `purchase()` returns directly into `purchase_with_credits()`. 4. The client submits the credits payment using the stored agent identifier. 5. No price, reputation, budget, or confirmation policy is evaluated. 6. Credits are spent and attacker-controlled Skill content may ...[truncated 372 chars]- Remediation
View remediation