x402 Agent Payments

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 5:13 AM UTC
• Version: 1.0.4

Overview

This payment skill is high-impact because it can help agents create charges, refunds, subscriptions, wallets, and crypto transfers, but the artifacts disclose that purpose and include user-confirmation and endpoint-scope controls.

Install only if you intend to let the agent assist with real payment operations. Use least-privilege API keys, keep crypto wallets low-balance, verify every recipient, amount, currency, fee, subscription cadence, and refund before execution, and use the official Spraay gateway unless you explicitly control the alternative HTTPS gateway.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (16)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 60% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

and the configured `SPRAAY_GATEWAY_URL`). No data is sent to any other
external service. The skill works with any combination of rails — set only
the env vars you need. API keys go only to their own provider's endpoint,
are passed to curl via stdin config (`-K -`) so they never appear in
process arguments or shell history, and never appear in URLs, logs, or
messages.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 60% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

Confirm the product, price, and currency with the user first.

bash

curl -X POST "https://api.stripe.com/v1/checkout/sessions" \
  -d "mode=payment" \
  -d "success_url=https://example.com/success" \
  -d "cancel_url=https://example.com/cancel" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This example initiates a real external payment flow to Stripe and includes user-controlled payment parameters. In a payment skill, outbound transmission is expected, but it is still security-sensitive because misuse, prompt injection into parameters, or absent confirmation could trigger unauthorized charges or disclosure of transaction metadata to a third party.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

Confirm the product, price, and currency with the user first.

bash

curl -X POST "https://api.stripe.com/v1/checkout/sessions" \
  -d "mode=payment" \
  -d "success_url=https://example.com/success" \
  -d "cancel_url=https://example.com/cancel" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This example initiates a real external payment flow to Stripe and includes user-controlled payment parameters. In a payment skill, outbound transmission is expected, but it is still security-sensitive because misuse, prompt injection into parameters, or absent confirmation could trigger unauthorized charges or disclosure of transaction metadata to a third party.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

Confirm the product, price, and currency with the user first.

bash

curl -X POST "https://api.stripe.com/v1/checkout/sessions" \
  -d "mode=payment" \
  -d "success_url=https://example.com/success" \
  -d "cancel_url=https://example.com/cancel" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

Creating a Stripe payment intent is a real external money movement precursor and can authorize collection attempts with user-supplied values. In context this is intended functionality, but it remains a true security-sensitive sink because compromised agent behavior or insufficient validation could generate unauthorized payment objects.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

Create Payment Intent

bash

curl -X POST "https://api.stripe.com/v1/payment_intents" \
  -d "amount=5000" \
  -d "currency=usd" \
  -d "payment_method_types[]=card" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This transmits invoice details to Stripe, including customer identifiers and billing amounts, which are sensitive financial records. While normal for a payment skill, it is dangerous if the agent can be induced to send incorrect charges, leak customer data, or invoice the wrong party.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

Confirm invoice details with the user first.

bash

curl -X POST "https://api.stripe.com/v1/invoiceitems" \
  -d "customer=cus_..." \
  -d "amount=5000" \
  -d "currency=usd" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

Subscription creation establishes recurring charges, raising the impact beyond a one-time payment because errors can persist over time. Even though the behavior is intentional, it is a sensitive external action that could be abused to enroll a customer into unwanted billing.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

Create Subscription

bash

curl -X POST "https://api.stripe.com/v1/subscriptions" \
  -d "customer=cus_..." \
  -d "items[0][price]=price_..." \
  -K - <<EOF

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 74% confidence

Finding

Payment status lookups transmit payment identifiers and credentials to Stripe, exposing financial metadata to a third party and creating a sensitive read action. This is less dangerous than a write operation but still security-relevant because unauthorized lookups can leak transaction information.

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

Check Payment Status

bash

curl "https://api.stripe.com/v1/payment_intents/pi_..." \
  -K - <<EOF
user = "$STRIPE_SECRET_KEY:"
EOF

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

Refund issuance is an external funds operation and can directly move money if invoked on the wrong payment intent. In a financial skill this is expected functionality, but it remains a true vulnerability sink because an attacker could abuse the agent to refund unauthorized transactions.

Content

Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.

Confirm refund with the user first.

bash

curl -X POST "https://api.stripe.com/v1/refunds" \
  -d "payment_intent=pi_..." \
  -K - <<EOF
user = "$STRIPE_SECRET_KEY:"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

This creates a Coinbase Commerce charge and sends merchant-defined invoice metadata to an external processor. That is intended for accepting crypto, but it is still a high-risk sink because malformed or manipulated parameters could create fraudulent payment requests or leak commercial data.

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

Confirm the amount and currency with the user first.

bash

curl -X POST "https://api.commerce.coinbase.com/charges" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Service Payment",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 73% confidence

Finding

Charge status retrieval discloses payment status and uses an API credential against an external service. This is a legitimate read operation, but still sensitive because unauthorized queries could reveal transaction activity or customer payment state.

Content

Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.

Check Charge Status

bash

curl "https://api.commerce.coinbase.com/charges/CHARGE_ID" \
  -K - <<EOF
header = "X-CC-Api-Key: $COINBASE_COMMERCE_API_KEY"
EOF

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 79% confidence

Finding

Canceling a Commerce charge can disrupt payment collection and alter transaction state at a third-party provider. This is not inherently malicious, but it is a sensitive external operation that could be abused to interfere with legitimate customer payments.

Content

Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.

Cancel a Charge

bash

curl -X POST "https://api.commerce.coinbase.com/charges/CHARGE_ID/cancel" \
  -K - <<EOF
header = "X-CC-Api-Key: $COINBASE_COMMERCE_API_KEY"
EOF

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

Creating a Coinbase CDP wallet provisions agent-managed crypto infrastructure at an external provider. This is sensitive because it can create custody surfaces, new identities, and downstream fund-handling capability if triggered unintentionally.

Content

Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.

Create Wallet

bash

curl -X POST "https://api.developer.coinbase.com/platform/v1/wallets" \
  -H "Content-Type: application/json" \
  -d '{"network": "base"}' \
  -K - <<EOF

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This sends a crypto transfer request to Coinbase CDP with destination, asset, and amount, directly enabling irreversible blockchain fund movement. The skill warns about confirmation, which reduces risk, but this remains the highest-risk sink because any prompt-injection or parameter tampering could cause permanent loss of funds.

Content

Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.

Confirm recipient, amount, and token with the user first.

bash

curl -X POST "https://api.developer.coinbase.com/platform/v1/wallets/WALLET_ID/transfers" \
  -H "Content-Type: application/json" \
  -d '{
    "destination": "0x1111111111111111111111111111111111111111",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 72% confidence

Finding

Balance checks expose wallet identifiers and financial holdings to an external provider and return sensitive account information. This is expected in a wallet-management skill but still security-relevant because unauthorized access could leak asset balances and wallet relationships.

Content

Scanner excerpt · SKILL.md (reported line 298)May include surrounding context.

Check Balance

bash

curl "https://api.developer.coinbase.com/platform/v1/wallets/WALLET_ID/balances" \
  -K - <<EOF
header = "Authorization: Bearer $CDP_API_KEY"
EOF

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This sends payroll-related data to an external gateway, which is inherently sensitive because even a headcount can reveal business information and may precede real-funds execution. The skill does include trust guidance for the gateway, but the configurable SPRAAY_GATEWAY_URL makes the transmission dangerous if the endpoint is misconfigured or adversarial.

Content

Scanner excerpt · SKILL.md (reported line 449)May include surrounding context.

confirms the roster. Estimate takes just the headcount:

bash

curl -X POST "$SPRAAY_GATEWAY_URL/api/v1/payroll/estimate" \
  -H "Content-Type: application/json" \
  -d '{"employeeCount": 12}'

Static analysis

No suspicious patterns detected.