Security audit
Security checks for vulnerabilities and agentic risk
This skill is for real blockchain payments and is mostly coherent, but it gives agents broad wallet/secret discovery and raw-key payment authority that users should review carefully before installing.
Install only in an agent environment that requires explicit human approval for every command and every transaction. Prefer a dedicated low-balance wallet or managed signer with spend limits and allowlists. Avoid generic PRIVATE_KEY-style variables in the agent environment, do not fund it with more than you can afford to lose, and review any generated .env files, wallet sessions, and paid endpoint URLs before use.
references/detecting-wallets.md:12Overbroad wallet discovery instructs the agent to inspect sensitive configuration and execution context
scripts/pay.mjs:25Payment code automatically reuses generic private-key environment variables
scripts/wallet.mjs:75Raw private keys are exposed through command-line arguments, standard output, and plaintext environment files
scripts/check-price.mjs:15Unrestricted endpoint requests enable server-side request forgery from the agent environment
SKILL.md:57Dependency installation is not reproducible and optional wallet packages are unpinned
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
**b. Network Connection.** As a material condition of this License, all use, distribution or derivatives works of the WalletKit Items must connect to the proprietary Reown gateway infrastructure, or its successor, and its related WalletConnect messaging protocol (collectively, the “**Network**”) unless we explicitly approve you doing otherwise. You further agree not to circumvent this requirement, or instruct or suggest to Your end users to do so.
**c. Compliance with Law.** We are not in a position to monitor and assess the legality and regulatory treatment of your business and operations. Your use of the WalletKit Items must comply with all applicable laws and regulations and Our Terms of Service and Acceptable Use Policy, as amended from time to time, the terms of which are incorporated herein by reference.
**d. Use of Marks.** This License does not grant permission to use Our trade names, trademarks, service marks, or product names (collectively, the “**Marks**”), except as permitted by Our Marks usage guidelines or as required for disclosure of the development of Your applications or wallets, reproducing the attribution notice in the readme.txt file, or Your redistribution of WalletKit Items. We reserve all rights not expressly granted to you under this License. Unless explicitly approved by Us, in no event will You use Our name, trademarks, or logos to endorse or imply Our endorsement of products derived from WalletKit Items or any products or services that use WalletKit Items. Where You are permitted to use the Marks, You must comply with Our then-current trademark and logo usage guidelines, as may be updated from time to time without notice from Us. All goodwill arising out of Your use of any Mark will inure solely to Us.
The README tells users to place live wallet secrets such as NEAR_PRIVATE_KEY and other payment credentials in the agent root .env, then to give the agent context on how to use them for transfers. In an agent skill that executes commands and handles cross-chain payments, concentrating reusable private keys in the runtime environment materially increases the blast radius of prompt injection, command abuse, or accidental secret exposure.
For example if you have funds in a NEAR wallet, in your task prompt or CLAUDE.md file you could state:
You have USDC in your NEAR account. Its account ID is in the NEAR_ACCOUNT_ID environment variable and a NEAR_PRIVATE_KEY is configured in the .env file in the agent root.
To send USDC from NEAR (USDC contract: 17208628f84f5d6ad33f0da3bbbeb27ffcb398eac501a31bd6ad2011e36133a1):
Referenced artifact was not completely inspected
node scripts/search-services.mjs search
Referenced artifact was not completely inspected
node scripts/search-services.mjs search
Referenced artifact was not completely inspected
node scripts/search-services.mjs search
Referenced artifact was not completely inspected
Check your wallet's USDC balance on Base — see `references/wallet-flows.md` for the method for your wallet (if you don't already know it) — and compare it again
Referenced artifact was not completely inspected
Check your wallet's USDC balance on Base — see `references/wallet-flows.md` for the method for your wallet (if you don't already know it) — and compare it again
Referenced artifact was not completely inspected
Check your wallet's USDC balance on Base — see `references/wallet-flows.md` for the method for your wallet (if you don't already know it) — and compare it again
Referenced artifact was not completely inspected
Check your wallet's USDC balance on Base — see `references/wallet-flows.md` for the method for your wallet (if you don't already know it) — and compare it again
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
// Shared .env loader for scripts that need wallet credentials or RPC config.
//
// Precedence (highest wins):
// 1. Shell env — already in process.env from `export VAR=...`
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
// Shared .env loader for scripts that need wallet credentials or RPC config.
//
// Precedence (highest wins):
// 1. Shell env — already in process.env from `export VAR=...`
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
// Shared .env loader for scripts that need wallet credentials or RPC config.
//
// Precedence (highest wins):
// 1. Shell env — already in process.env from `export VAR=...`
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
// Shared .env loader for scripts that need wallet credentials or RPC config.
//
// Precedence (highest wins):
// 1. Shell env — already in process.env from `export VAR=...`
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const SKILL_DIR = join(dirname(fileURLToPath(import.meta.url)), '..');
export function loadEnv() {
config({ path: join(process.cwd(), '.env'), quiet: true });
config({ path: join(SKILL_DIR, '.env'), quiet: true });
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const SKILL_DIR = join(dirname(fileURLToPath(import.meta.url)), '..');
export function loadEnv() {
config({ path: join(process.cwd(), '.env'), quiet: true });
config({ path: join(SKILL_DIR, '.env'), quiet: true });
}
The README instructs users to run npx skills add NearDeFi/agent-payments-skill without pinning a version or commit. That creates a supply-chain risk because the fetched package can change over time, and this skill is explicitly used in money-moving agent environments where compromised updates could lead to credential theft or unauthorized payments.
The skill may reuse an existing wallet session or create a new wallet automatically, and specifically instructs AWAL login via the terminal session used by the agent. Persistent authenticated wallet sessions in an agent runtime increase the risk that subsequent prompts, chained tools, or session compromise can trigger unauthorized transactions without re-authentication.
The skill will check the agent's context for configured wallets. It requires a wallet on Base, and will either use an existing wallet or create one if none is already configured. The skill has explicit wallet support for AWAL, CDP, Privy, Turnkey, and private key. To use your AWAL wallet, log in via the terminal where the agent executes commands. For other wallets, configure the relevant environment variables in a .env file in the root of your agent.
# To use CDP configure the following environment variables
The skill explicitly requires internet access and references numerous environment variables for wallets and API credentials, yet it does not declare an explicit tool/permission scope such as allowed-tools or permissions. In an agent platform, this can cause the skill to run with broader-than-expected access to network and secrets, increasing the chance of unintended outbound requests or exposure/misuse of wallet material during payment and funding flows.
The skill instructs the agent to embed the unique deposit address into a third-party QR generation service URL, which transmits sensitive transaction metadata off-platform. In this skill's context, deposit addresses are tied to a live payment quote and may reveal wallet relationships or payment activity to an external service; if that service is compromised or altered, users could also be misled into sending funds to an incorrect address despite the warning to visually verify it.
When you give the deposit address to the user to send to (external-wallet funding), you can also offer a scannable QR of it:
https://api.qrserver.com/v1/create-qr-code/?size=240x240&data=<Deposit to: address>
Put the exact Deposit to: address in the data parameter. Always tell the user to check that the address their wallet shows after scanning matches the Deposit to: address printed by the script — if they differ, the QR is wrong or corrupted and they must not send.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
}); const fetchWithPayment = wrapFetchWithPayment(fetch, client);
const res = await fetchWithPayment('https://api.example.com/data'); console.log(await res.text()); // the paid response body
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import https from 'https';
const X402LIST_API = 'https://x402-list.com/api/v1';
const BAZAAR_API = 'https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources';
const PAGE_SIZE = 1000;
const args = process.argv.slice(2);
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
========================================================================
2. BSD 2 Clause
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
========================================================================
2. BSD 2 Clause
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
========================================================================
2. BSD 2 Clause
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
========================================================================
2. BSD 2 Clause
No suspicious patterns detected.