multi-news-aggregator-via x402

Agent skill for x402-paid global news aggregation and source/time-filtered search.

Security Scan

The skill's instructions require a raw EVM private key and an on-chain payment signing flow that are not declared in the registry metadata and are disproportionate for a news-aggregation skill, so proceed with caution.

Purpose & Capability

The stated purpose is news aggregation/search. The SKILL.md describes an x402 pay-per-call flow that requires creating and signing an EVM payment payload with a raw private key. Requiring a raw EVM_PRIVATE_KEY is not obviously necessary for plain news search and is not declared in the registry metadata (which lists no required env vars). While on-chain payment signing could be a legitimate design, the registry-data vs. SKILL.md mismatch and lack of publisher/source/website is a red flag.

Instruction Scope

The runtime instructions explicitly tell the agent to read EVM_PRIVATE_KEY from environment, derive an account, create/sign a payment payload, and retry the API call with a signature. These steps go beyond typical 'search' behavior because they require handling a sensitive signing key and performing payment operations. The instructions also use inconsistent env var names (X402_API_BASE_URL vs API_BASE_URL) which suggests sloppy or incomplete documentation.

Install Mechanism

This is an instruction-only skill with no install spec and no code files, so nothing is written to disk by the skill itself. That lowers installation risk.

Credentials

The SKILL.md asks for EVM_PRIVATE_KEY (a raw blockchain private key) which grants the ability to sign on-chain payments and potentially spend funds. The registry metadata lists no required env vars or primary credential, so the request for a raw private key is unexpected and disproportionate for a news search skill unless clearly documented and justified. The skill also reads API_BASE_URL/X402_API_BASE_URL; those are reasonable, but the private-key requirement is high-risk.

Persistence & Privilege

The skill is not marked always:true (good) and is user-invocable/autonomous invocation is allowed by default. Combined with the instruction to read a raw EVM private key from environment, autonomous invocation could cause the agent to sign/payment-authorize requests without additional human confirmation, which creates a high potential for unintended fund spending. The skill does not request or modify other skills' configs, but the private-key usage raises privilege concerns.

What to consider before installing

This skill's documentation asks your agent to use a raw EVM private key to sign payments but the registry metadata does not declare any required credentials — that's an inconsistency and a security risk. Do not put a full/private blockchain key (EVM_PRIVATE_KEY) in the agent environment unless you fully trust the publisher. If you need this capability: (1) require the publisher to declare required env vars and provide a verifiable homepage/source; (2) prefer using a separate signing service or hardware wallet that can approve signatures interactively; (3) if you must supply a key, use an ephemeral/minimal-funds account that can only cover expected payments; (4) verify the API base (https://www.x402api.app/) and confirm the payment protocol with the service provider; (5) ask the publisher to fix the inconsistent env var names and to clearly explain why a raw private key is required. If you cannot validate the publisher or the payment design, avoid installing or enabling this skill with access to any real private key or funds.

x402 News Search Skill (Local Only)

Use this skill to let your AI agent search global news via:

• API base: https://www.x402api.app/
• Endpoint: POST /api/v1/news/search
• Payment: x402 pay-per-call

This is a news aggregation capability: your agent can search across web-indexed news sources, including major US and European outlets, and can filter by source domain and publication time.

What this skill is for

• Search broad global news by keyword
• Filter by source domain (for example cnn.com, bloomberg.com, ft.com)
• Filter by publication time range (time_published)
• Keep the same x402 payment flow used by your other endpoints

Environment variables

EVM_PRIVATE_KEY=0x_your_private_key
API_BASE_URL=https://www.x402api.app/

API contract

Endpoint:

POST /api/v1/news/search

Body example:

{
  "query": "Federal Reserve rates",
  "limit": 10,
  "time_published": "7d",
  "source": "bloomberg.com",
  "country": "US",
  "lang": "en"
}

Parameters

• query (required): search keywords
• limit (optional): 1-500, default 10
• time_published (optional): time filter (for example anytime, 1h, 1d, 7d, 1y)
• source (optional): source domain filter, for example cnn.com
• country (optional): 2-letter country code, default US
• lang (optional): 2-letter language code, default en

x402 payment flow (same pattern as your other APIs)

1. Call the endpoint without payment and get 402 Payment Required.
2. Parse payment requirements from response headers.
3. Create and sign payment payload.
4. Retry with payment signature header.
5. Read final response body.

Example buyer code

import { x402Client, x402HTTPClient } from "@x402/core/client";
import { ExactEvmScheme, toClientEvmSigner } from "@x402/evm";
import { createPublicClient, http } from "viem";
import { privateKeyToAccount } from "viem/accounts";
import { base } from "viem/chains";

const baseUrl =
  process.env.X402_API_BASE_URL ??
  process.env.API_BASE_URL ??
  "https://www.x402api.app/";
const endpoint = `${baseUrl.replace(/\/$/, "")}/api/v1/news/search`;

async function main() {
  const privateKey = process.env.EVM_PRIVATE_KEY;
  if (!privateKey) throw new Error("Missing EVM_PRIVATE_KEY");
  if (!privateKey.startsWith("0x")) throw new Error("EVM_PRIVATE_KEY must start with 0x");

  const account = privateKeyToAccount(privateKey as `0x${string}`);
  const publicClient = createPublicClient({ chain: base, transport: http() });
  const signer = toClientEvmSigner(account, publicClient);
  const client = new x402Client().register("eip155:*", new ExactEvmScheme(signer));
  const httpClient = new x402HTTPClient(client);

  const payload = {
    query: "AI chip demand",
    limit: 10,
    time_published: "7d",
    source: "reuters.com",
    country: "US",
    lang: "en",
  };

  const unpaid = await fetch(endpoint, {
    method: "POST",
    headers: { "content-type": "application/json" },
    body: JSON.stringify(payload),
  });

  if (unpaid.status !== 402) {
    const text = await unpaid.text();
    throw new Error(`Expected 402, got ${unpaid.status}. body=${text}`);
  }

  const required = httpClient.getPaymentRequiredResponse(
    (name) => unpaid.headers.get(name),
    {},
  );
  const paymentPayload = await httpClient.createPaymentPayload(required);

  const paid = await fetch(endpoint, {
    method: "POST",
    headers: {
      "content-type": "application/json",
      ...httpClient.encodePaymentSignatureHeader(paymentPayload),
    },
    body: JSON.stringify(payload),
  });

  const result = await paid.json();
  if (!paid.ok) throw new Error(`Request failed: ${paid.status} ${JSON.stringify(result)}`);
  console.log(result);
}

void main().catch((error) => {
  console.error(error);
  process.exit(1);
});

News aggregation coverage (major outlets)

The search can cover web-indexed mainstream media, including but not limited to:

United States

• The New York Times (nytimes.com)
• The Washington Post (washingtonpost.com)
• The Wall Street Journal (wsj.com)
• Bloomberg (bloomberg.com)
• Reuters (reuters.com)
• Associated Press (apnews.com)
• CNN (cnn.com)
• Fox News (foxnews.com)
• NBC News (nbcnews.com)
• ABC News (abcnews.go.com)
• CBS News (cbsnews.com)
• USA Today (usatoday.com)
• Los Angeles Times (latimes.com)
• Politico (politico.com)
• Axios (axios.com)
• Business Insider (businessinsider.com)
• Forbes (forbes.com)
• The Atlantic (theatlantic.com)
• Time (time.com)
• Newsweek (newsweek.com)

Europe / UK

• Financial Times (ft.com)
• The Economist (economist.com)
• BBC News (bbc.com)
• Reuters Europe coverage (reuters.com)
• The Guardian (theguardian.com)
• The Times (thetimes.co.uk)
• The Telegraph (telegraph.co.uk)
• Sky News (news.sky.com)
• Euronews (euronews.com)
• POLITICO Europe (politico.eu)
• Le Monde (lemonde.fr)
• Le Figaro (lefigaro.fr)
• AFP (afp.com)
• Der Spiegel (spiegel.de)
• Die Zeit (zeit.de)
• Frankfurter Allgemeine Zeitung (faz.net)
• Handelsblatt (handelsblatt.com)
• El País (elpais.com)
• El Mundo (elmundo.es)
• Corriere della Sera (corriere.it)
• La Repubblica (repubblica.it)
• ANSA (ansa.it)
• NRC (nrc.nl)
• De Telegraaf (telegraaf.nl)
• Swissinfo (swissinfo.ch)

Note: Coverage depends on upstream indexing and availability; this list represents major outlets that are commonly discoverable.

Recommended agent behaviors

• If the user specifies a media brand, map it to domain and set source.
• If the user asks “latest”, set a tighter time_published (like 1d or 7d) and then sort/compare timestamps.
• If result count is low, remove source first, then expand time range.
• Always surface source domain + publish time in final answer.

Error handling

• 402 Payment Required: generate payment payload and retry.
• invalid_json_body (400): send valid JSON.
• invalid_news_request (400): fix query/limit/source format.
• news_upstream_auth_failed (502): server-side upstream auth issue.
• news_upstream_rate_limited (429): retry with backoff.
• news_upstream_error (502): transient upstream failure, retry.