Riley AI Visibility

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:32 AM UTC
• Version: 1.0.0

Overview

The skill is coherent and openly describes paid AI-visibility API calls, but it can trigger USDC x402 payments without clear per-transaction user confirmation or spending limits.

Review this before installing if your agentcash/x402 setup can spend from a wallet. Use the free samples endpoint first, confirm every paid request, and set wallet or client-side spending limits before allowing this skill to call the paid endpoints.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:25

Finding

Paid Requests May Be Retried Without Explicit Transaction Confirmation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-26
Vulnerability Type: Uncontrolled cryptocurrency payment authorization
Risk Level: Medium

markdown

> All endpoints are GET on `https://store.agentexchange.work`. Paid calls return HTTP 402;
> your x402 client signs USDC on Base and retries. Free preview: `GET /samples`.

Technical Analysis

The Skill instructs an x402 client to sign a USDC payment on the Base network and retry a request after receiving HTTP 402. It does not require explicit user confirmation before signing, verify that the server-requested amount matches the documented price, define a maximum authorized payment, or impose retry and session spending limits.

The endpoint price table documents expected charges, but it does not constitute transaction-specific consent or enforce those prices. If an agent follows these instructions automatically, the external server's payment challenge can initiate cryptocurrency spending using the wallet authority available to the x402 client.

Attack Path

1. A user requests a brand, category, sales-lead, or cryptocurrency visibility operation.
2. The agent sends a request to the documented third-party service.
3. The service responds with an HTTP 402 payment challenge.
4. Following the Skill instructions, the x402 client signs a USDC payment on Base.
5. The client retries the paid request without obtaining transaction-specific user approval.
6. Repeated invocations or insufficiently bounded retry behavior may cause cumulative charges.

Impact Assessment

Exploitation is limited to the payment authority delegated to the x402 client and does not, based on the reviewed file, grant broader host or operating-system privileges. The primary impact is unauthorized or unexpected expenditure of USDC. The external service also receives the query parameters required for the request, such as brand names, categories, domains, or cryptocurrency project names.

No evidence was found of ...[truncated 123 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation before every paid request.
2. Display the destination endpoint, request parameters, recipient, blockchain network, token, exact charge, and maximum possible charge before authorization.
3. Validate the HTTP 402 payment request against a local allowlist and the documented endpoint price.
4. Reject charges that exceed a configured per-request limit or differ from the user-approved amount.
5. Add per-session and daily spending caps.
6. Permit no more than one payment attempt per approved operation unless the user separately authorizes another attempt.
7. Verify transaction and service-response status before considering a request complete.
8. Default to the free /samples endpoint where it can satisfy the request.
9. Record an auditable payment receipt without logging wallet secrets or signing material.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases are broad enough to match common user requests such as general questions about AI recommendations, visibility, or rankings, which can cause the skill to activate outside a narrowly intended context. Overbroad activation can lead to unintended external x402 calls, unnecessary paid requests, and routing of user queries to a third-party service when a simpler or safer handling path may have been appropriate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.