x402-cli

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:57 PM UTC
• Version: 1.0.3

Overview

This skill is for real USDC payments and is mostly transparent about that, but it asks agents to use a raw wallet private key with mutable third-party install sources and auto-confirm payment examples.

Review this carefully before installing. Use only a dedicated low-balance or testnet wallet, verify the endpoint, network, and price with the probe command before any payment, avoid storing the private key in shared shells or logs, and prefer a pinned, verified build of the CLI before giving it signing authority.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:12

Finding

Mutable Third-Party Payment Tool Creates a Supply-Chain Compromise Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:12-17; corroborating installation metadata at clawhub.json:11-16
Vulnerability Type: Unpinned and mutable third-party dependency
Risk Level: High

The skill directs users to install a cryptocurrency payment binary through installation references that do not identify an immutable, verified artifact.

Complete vulnerable configuration from SKILL.md:12-17:

yaml

- kind: brew
  formula: razvanmacovei/tap/x402-cli
  bins: [x402-cli]
- kind: go
  package: github.com/razvanmacovei/x402-cli@latest
  bins: [x402-cli]

Corroborating installation metadata from clawhub.json:11-16:

json

"install": {
  "brew": "brew install razvanmacovei/tap/x402-cli",
  "go": "go install github.com/razvanmacovei/x402-cli@latest",
  "binary": "https://github.com/razvanmacovei/x402-cli/releases/latest"
},

Technical Analysis

The Go installation uses the mutable @latest selector, while the direct binary URL uses the mutable releases/latest endpoint. The Homebrew command also installs from a third-party personal tap without pinning or verifying a specific package artifact. Consequently, the installed code can change after this skill has been reviewed.

This dependency is security-sensitive because the resulting binary is explicitly granted access to EVM_PRIVATE_KEY and is expected to sign USDC payment authorizations. The relevant secret declaration appears at SKILL.md:8-9:

yaml

env: [EVM_PRIVATE_KEY]
bins: [x402-cli]

The project does not include the upstream binary's implementation, a lock file, an artifact checksum, or a signature-verification procedure. Therefore, this audit cannot verify how the installed executable handles the private key or restricts payment destinations and amounts. This finding establishes an unsafe supply-chain configuration; it does not establish that the current upstream package is malicious.

Attack P

...[truncated 1447 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace github.com/razvanmacovei/x402-cli@latest with a specific reviewed semantic version or, preferably, an immutable commit identifier.
2. Replace releases/latest with a versioned release URL that cannot silently resolve to a newer artifact.
3. Publish SHA-256 or stronger checksums for every supported binary and verify the checksum before installation or execution.
4. Sign release artifacts using a verifiable mechanism such as Sigstore/cosign or GPG, and make signature verification mandatory in the installation process.
5. Pin the Homebrew formula and its source archive to a reviewed version and cryptographic digest. Prefer a trusted package distribution channel with provenance attestations.
6. Add a dependency lock or provenance record documenting the exact source revision from which each release was built.
7. Run the payment binary with least privilege and tightly restrict its outbound network access to explicitly approved endpoints.
8. Continue requiring a dedicated low-value wallet, and add enforceable limits for payment amount, destination, network, token, and cumulative spending.
9. Avoid exposing the raw private key to the process where possible. Use a restricted signer, hardware wallet, isolated signing service, or short-lived credential with explicit transaction-policy enforcement.
10. Audit the pinned upstream source and reproducibly build the binary before treating the dependency as trusted.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill directs users to place a blockchain wallet private key in an environment variable, which is a highly sensitive secret that grants spending authority over on-chain funds. Without an explicit warning about secure handling, scope limitation, and the financial risk of compromise, users may expose the key through shell history, logs, process inspection, or unsafe sharing, leading to unauthorized transactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented examples use the auto-confirm flag (-y) for payment operations, which can immediately authorize USDC spending against payment-gated endpoints. Because the skill does not clearly warn that these commands initiate real blockchain payments and may spend funds on the target network, users may run copy-pasted examples without understanding the financial consequence.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.