x402janus

This skill largely does what it claims — scanning approvals and building revoke txs — but there are red flags you should address before installing or running it. What to check before installing or running: - Verify provenance: the submitted registry metadata differs from SKILL.md (required envs and binaries). Confirm the source repository/website (https://x402janus.com and the GitHub link in SKILL.md) actually match the code you received. - Do not supply your primary, full‑balance private key. For paid tiers or any run that requires PRIVATE_KEY, use a dedicated agent wallet with minimal funds and only enough USDC to pay micropayments. Prefer ephemeral or watch‑only wallets where possible. - Audit the revoke script carefully: it spawns an external 'cast' process; ensure the implementation does NOT pass your private key on the command line (ps/args exposure) or write it to logs. The source contains comments indicating this may not be fully fixed. - Review network endpoints: the code defaults to third‑party RPCs (tenderly) if BASE_RPC_URL is not set. That can leak which addresses you're interacting with to a third party. Set BASE_RPC_URL to a trusted RPC or your own node. - Consider running in an isolated environment (temporary container or VM) and inspect network traffic when you run the tool, especially first runs and paid-tier flows. - If you only need read-only scans, prefer the Free tier which does not require PRIVATE_KEY. If you need paid tiers, confirm the JANUS_API_URL endpoint is authentic and review the server's 402 challenge flow. If you want, I can: (1) search the provided code for exact places where PRIVATE_KEY may be passed to child processes, (2) extract the exact spawn arguments in the revoke script to confirm whether keys are passed on the CLI, or (3) produce a short checklist/patch suggestions to harden the scripts (avoid CLI args for secrets, require BASE_RPC_URL, add clearer metadata).