ClawHub
Back to skill

Security audit

payment-402

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for x402 payments, but it can automatically spend from a local private-key wallet and needs careful review before use.

Install only if you intend to let an agent make x402 payments. Use a dedicated burner wallet with very low funds, avoid a primary wallet private key, review the PayNode SDK/dependencies, and require explicit user approval or an allowlist/budget before allowing paid requests.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs users to place a wallet private key in a local .env file and then use Bun-based tooling that will read it for signing and broadcasting transactions. A raw private key in the local environment is highly sensitive and may be exposed through shell history, process inspection, logs, crash reports, developer tooling, or other local compromise, making theft of funds and wallet takeover possible.

Static analysis

No suspicious patterns detected.