Bittensor Chutes x402

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:17 AM UTC
• Version: 1.0.0

Overview

The skill matches its stated purpose, but it asks users to run unpinned third-party setup code before adding API key and payment configuration.

Install only after reviewing or pinning the referenced x402 packages and generated project dependencies. Use a throwaway or low-privilege Chutes key for testing, keep .env out of version control and screenshots, prefer platform secret managers for deployment, and review generated code before adding real API or payment configuration.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Third-Party Packages Are Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35-53; additional occurrence at lines 171-175
Vulnerability Type: Unreviewed and unpinned supply-chain dependency execution
Risk Level: Medium

Vulnerable Code

bash

npx @primersystems/x402 create chutes-proxy my-ai-proxy
cd my-ai-proxy
npm install
cp .env.example .env
# Edit .env with your Chutes API key and wallet address
npm run dev

bash

pip install primer-x402
x402 create chutes-proxy my-ai-proxy
cd my-ai-proxy
pip install -r requirements.txt
cp .env.example .env
# Edit .env with your Chutes API key and wallet address
uvicorn main:app --reload

An additional command downloads and executes the same unpinned npm package:

bash

npx @primersystems/x402 pay http://localhost:8787/v1/chat/completions \
  --max-amount 0.01 \
  --method POST \
  --body '{"messages":[{"role":"user","content":"Hello"}]}'

Technical Analysis

The Skill instructs users or agents to install and execute npm and Python packages without pinning exact versions or validating package integrity. In particular, npx @primersystems/x402 may retrieve the current registry release and execute its code immediately. Similarly, pip install primer-x402, npm install, and pip install -r requirements.txt may execute package installation or build logic and introduce unreviewed transitive dependencies.

The downloaded package, generated application, dependency manifests, and lockfiles are not included in the audited project. Consequently, the effective code executed by these instructions can change after this Skill has been reviewed. The audit found no evidence that the named packages are currently malicious; the vulnerability is the unsafe trust and execution model.

This is especially sensitive because users are subsequently instructed to place a Chutes API key and a payment wallet address into the generated application. Compromised packag ...[truncated 1599 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every directly invoked npm and Python package to a reviewed exact version rather than relying on the latest registry release.
2. Commit dependency lockfiles for the generated templates and require deterministic, lockfile-enforced installation modes such as npm ci.
3. Publish and verify package integrity hashes or signed release provenance before execution.
4. Avoid using npx in a mode that automatically downloads the current package release. Require a separately installed, version-pinned, verified CLI.
5. Pin and audit all dependencies in the generated package-lock.json or Python requirements file, including transitive dependencies where practical.
6. Include the generated template source in the reviewed Skill or link to an immutable commit and verify its checksum before use.
7. Review generated code before adding CHUTES_API_KEY, wallet configuration, or other secrets.
8. Run scaffolding and dependency installation in an isolated, non-privileged environment with minimal filesystem and network access.
9. Add automated dependency scanning, release-signature verification, and publisher-account protections to the package release process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

npx @primersystems/x402 create chutes-proxy my-ai-proxy cd my-ai-proxy npm install cp .env.example .env

Edit .env with your Chutes API key and wallet address

npm run dev

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

npx @primersystems/x402 create chutes-proxy my-ai-proxy cd my-ai-proxy npm install cp .env.example .env

Edit .env with your Chutes API key and wallet address

npm run dev

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The instruction to edit .env with a live Chutes API key and wallet address, without adjacent warnings about secure handling, can lead to accidental secret disclosure through version control, backups, shell history, or local file leakage. While not malicious, the skill normalizes storing production credentials in a plaintext file without sufficient safeguards.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

cd my-ai-proxy npm install cp .env.example .env

Edit .env with your Chutes API key and wallet address

npm run dev

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

As with the Node.js example, instructing users to place a real API key and wallet address into .env without security warnings can cause accidental credential exposure. In a deployment-oriented skill, this becomes more dangerous because users may reuse production credentials and carry the same pattern into hosted environments.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

cd my-ai-proxy pip install -r requirements.txt cp .env.example .env

Edit .env with your Chutes API key and wallet address

uvicorn main:app --reload

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

Using --env-file .env when running a container propagates sensitive values into the container runtime, and the skill does not warn about protecting the .env file or limiting credential exposure. This can lead to secret leakage through filesystem access, mismanaged deployment artifacts, or operational practices such as sharing env files between systems.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

bash

docker build -t chutes-proxy .
docker run -p 8000:8000 --env-file .env chutes-proxy

Other Platforms

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

The skill instructs users to execute npx @primersystems/x402 without pinning a specific package version. This creates a supply-chain risk because a future compromised or malicious package release could be fetched and executed at runtime with the user's privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

bash

# Should return 402 Payment Required
curl http://localhost:8787/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{"messages":[{"role":"user","content":"Hello"}]}'

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill directs users to configure a sensitive CHUTES_API_KEY and deploy services using environment variables, but it does not include explicit guidance on secret hygiene, storage, rotation, or preventing accidental exposure. In deployment-focused documentation, that omission increases the likelihood of users committing secrets to source control, logs, or misconfigured platforms.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.