ClawHub
Back to skill

Security audit

Agent Wallet For x402

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says, but it can spend USDC automatically and documents a wallet token in a bind link, so it needs careful review before installation.

Review this skill as a real-money wallet integration. Only install it if you trust SynapseAI, understand the spending limits and approval settings, and can revoke or rotate tokens. Configure low transaction and daily limits, require approval for meaningful amounts, restrict merchants, and avoid sharing bind links or putting secrets in payment metadata.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:56
Finding

Registration Bearer Credential Exposed in a URL Query Parameter

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–17 and 56–61
Vulnerability Type: Bearer credential exposure through a URL query parameter
Risk Level: Medium

Vulnerable Code

markdown
## Authentication

All requests (except `/register-agent`) use Bearer token:

```http
Authorization: Bearer <registration_token>
text

```markdown
{
  "agent_id": "agt_abc123",
  "wallet_id": "wal_xyz789",
  "status": "PENDING_USER_BIND",
  "registration_token": "reg_def456",
  "bind_url": "/bind?token=reg_def456"
}

After registration, tell owner to open:

text
https://wallet.synapseai.pro/bind?token=reg_def456

Technical Analysis

The documentation identifies registration_token as the bearer credential used to authenticate wallet API requests, then places that same token in the binding URL's query string. Sensitive credentials in URLs can be retained or disclosed through browser history, copied links, screenshots, reverse-proxy and web-server access logs, monitoring or analytics systems, and potentially referrer metadata.

The documentation does not establish that the URL token is a distinct credential, that it is single-use or short-lived, that it has restricted binding-only scope, or that it is immediately invalidated after binding. Consequently, compromise of the binding URL may expose a credential accepted by the documented authenticated endpoints.

Attack Path

  1. An agent registers a wallet and receives a registration_token.
  2. The agent sends the owner a binding URL containing that token as a query parameter.
  3. The owner opens or shares the URL, causing it to be stored or processed by a browser, intermediary, access log, analytics platform, screenshot, or communication history.
  4. An attacker obtains the complete URL from one of those sources.
  5. The attacker extracts the token query value.
  6. The attacker submits that value as an Authorization: Bearer credential to the documented wallet endpoints.
  7. If ...[truncated 799 chars]
Remediation
View remediation

Remediation Suggestions

  1. Generate a distinct binding credential that cannot authenticate wallet API requests.
  2. Make the binding credential cryptographically random, narrowly scoped, short-lived, and single-use.
  3. Exchange the binding credential through a POST request rather than exposing a reusable bearer credential in a URL query parameter.
  4. Invalidate the binding credential immediately after successful use or expiration.
  5. Rotate the API registration credential after owner binding so any previously exposed value becomes unusable.
  6. Redact sensitive query parameters from application, proxy, CDN, monitoring, and analytics logs.
  7. Apply a restrictive Referrer-Policy, such as no-referrer, to binding pages.
  8. Prevent third-party resources from loading on pages while a sensitive binding value is present.
  9. Document the credential separation, expiration period, scope, replay protections, and post-binding invalidation behavior.
  10. Continue enforcing transaction limits, daily limits, merchant allowlists, and owner approval independently of possession of the bearer token.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
| Service | URL |
|---------|-----|
| Edge Functions (register, query) | `https://api.synapseai.pro/functions/v1` |
| x402 Proxy (payments) | `https://wallet.synapseai.pro/api/app` |

## Flow

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly enables automated on-chain USDC payments but does not present a prominent warning that actions may move real funds and incur irreversible spending. In an agent context, this omission is dangerous because operators may treat the skill like a simulation or low-risk API integration and authorize autonomous payment flows without fully understanding the financial consequences.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
POST {PROXY_URL}/x402-proxy
Authorization: Bearer <registration_token>
{
  "target_url": "https://api.example.com/premium",
  "merchant": "openai_api",
  "amount_hint": 5.0,
  "purpose": "GPT-4 API credits for task #42",