x402 Agent Payments

• Outcome: Pass
• Latest audit: Jun 19, 2026 · 6:57 PM UTC
• Version: 1.0.1

Overview

This is a high-risk payment helper, but its real-money behavior, credentials, and external providers are disclosed and aligned with its stated purpose.

Install only if you intend to let an agent help with real payment workflows. Use test mode or least-privilege API keys where possible, avoid granting production transfer authority unless necessary, and require the agent to show the exact amount, currency, recipient, provider, and action before every charge, refund, subscription, wallet transfer, payroll batch, or invoice operation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The quick-start examples are broad natural-language triggers for actions that move or charge real funds, but they do not define strict activation boundaries, confirmation requirements, or safe-read-only defaults. In an agent setting, this can cause overbroad invocation or unsafe action selection from casual user prompts, increasing the risk of unintended payments, transfers, or wallet operations involving irreversible financial loss.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The invocation text is very broad and encourages the skill to activate for many common requests involving payments, invoices, wallets, and transfers. In an agentic environment, over-broad routing increases the chance that a high-risk money-moving skill is selected in contexts where the user did not intend financial execution, which can amplify accidental payment actions or credentialed API use.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Confirm the product, price, and currency with the user first.**

```bash
curl -X POST "https://api.stripe.com/v1/checkout/sessions" \
  -u "$STRIPE_SECRET_KEY:" \
  -d "mode=payment" \
  -d "success_url=https://example.com/success" \

• Confidence: 92% confidence
• Finding: This example sends authenticated payment data to Stripe and can create live checkout sessions using the secret key. Because the skill is designed for real-funds operations, external transmission here is security-relevant: if invoked without strong confirmation gates, it can initiate financial workflows and disclose transaction metadata to a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Confirm the product, price, and currency with the user first.**

```bash
curl -X POST "https://api.stripe.com/v1/checkout/sessions" \
  -u "$STRIPE_SECRET_KEY:" \
  -d "mode=payment" \
  -d "success_url=https://example.com/success" \

• Confidence: 92% confidence
• Finding: This example sends authenticated payment data to Stripe and can create live checkout sessions using the secret key. Because the skill is designed for real-funds operations, external transmission here is security-relevant: if invoked without strong confirmation gates, it can initiate financial workflows and disclose transaction metadata to a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Create Payment Intent

```bash
curl -X POST "https://api.stripe.com/v1/payment_intents" \
  -u "$STRIPE_SECRET_KEY:" \
  -d "amount=5000" \
  -d "currency=usd" \

• Confidence: 90% confidence
• Finding: Creating a payment intent is a state-changing external API call using a privileged Stripe secret key. In a real agent deployment, this can prepare or trigger payment collection workflows based on model interpretation, so weak invocation controls or prompt confusion could lead to unauthorized charges or financial abuse.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Confirm invoice details with the user first.**

```bash
curl -X POST "https://api.stripe.com/v1/invoiceitems" \
  -u "$STRIPE_SECRET_KEY:" \
  -d "customer=cus_..." \
  -d "amount=5000" \

• Confidence: 88% confidence
• Finding: Invoice item creation transmits customer identifiers, amounts, and descriptions to Stripe, which is an external third party. Even though this is a normal business action, it is security-sensitive because it can expose billing metadata and create financial obligations if the skill is invoked accidentally or with manipulated inputs.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Create Subscription

```bash
curl -X POST "https://api.stripe.com/v1/subscriptions" \
  -u "$STRIPE_SECRET_KEY:" \
  -d "customer=cus_..." \
  -d "items[0][price]=price_..."

• Confidence: 88% confidence
• Finding: Subscription creation is a recurring billing action, making this external transmission higher risk than a one-time status lookup. If the agent invokes it from an ambiguous or maliciously framed request, it could create ongoing financial commitments for a customer.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Confirm refund with the user first.**

```bash
curl -X POST "https://api.stripe.com/v1/refunds" \
  -u "$STRIPE_SECRET_KEY:" \
  -d "payment_intent=pi_..."
```

• Confidence: 91% confidence
• Finding: Refund creation is a state-changing financial action against Stripe using privileged credentials. If misused, it can reverse funds improperly, enable fraud, or disrupt business operations, especially in agent contexts where user intent may be inferred incorrectly.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Confirm the amount and currency with the user first.**

```bash
curl -X POST "https://api.commerce.coinbase.com/charges" \
  -H "Content-Type: application/json" \
  -H "X-CC-Api-Key: $COINBASE_COMMERCE_API_KEY" \
  -d '{

• Confidence: 87% confidence
• Finding: Creating a Coinbase Commerce charge sends payment metadata to an external provider and initiates a live customer payment flow. This is security-relevant because it can cause unintended payment requests, expose commercial details, and potentially be triggered by overly broad skill routing.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Cancel a Charge

```bash
curl -X POST "https://api.commerce.coinbase.com/charges/CHARGE_ID/cancel" \
  -H "X-CC-Api-Key: $COINBASE_COMMERCE_API_KEY"
```

• Confidence: 84% confidence
• Finding: Canceling a charge is a state-changing external action that can interfere with legitimate payment collection. In an agent setting, incorrect cancellation triggered by ambiguous instructions or adversarial prompting could disrupt revenue and customer workflows.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Create Wallet

```bash
curl -X POST "https://api.developer.coinbase.com/platform/v1/wallets" \
  -H "Authorization: Bearer $CDP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"network": "base"}'

• Confidence: 86% confidence
• Finding: Wallet creation on Coinbase CDP is an authenticated external action that provisions agent-controlled crypto infrastructure. While not immediately transferring funds, it expands the attack surface by enabling new managed wallets that could later receive or send assets under agent control.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Confirm recipient, amount, and token with the user first.**

```bash
curl -X POST "https://api.developer.coinbase.com/platform/v1/wallets/WALLET_ID/transfers" \
  -H "Authorization: Bearer $CDP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 96% confidence
• Finding: This endpoint performs a live crypto transfer to a destination address using a bearer token, and blockchain transfers are typically irreversible. In the context of an agent skill with broad payment routing, any mis-invocation, prompt injection, recipient substitution, or parameter confusion could directly and permanently move funds to an unintended address.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.