T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:26
- Finding
- Unbounded Automatic Cryptocurrency Payments Through Externally Supplied Follow-Up Calls## Vulnerability Details **File Location**: `SKILL.md`, lines 26–27 and 43–44 **Vulnerability Type**: Unrestricted paid request automation and unsafe trust in externally supplied URLs **Risk Level**: High **Vulnerable Code Snippets**: ```markdown > All endpoints are GET on `https://store.agentexchange.work`. Paid calls return HTTP 402; > your x402 client signs USDC on Base and retries. Free preview: `GET /samples`. ``` ```markdown - `/crypto/launches` items include `next_calls` that point at the security + dex endpoints for that exact token — chain them automatically. ``` ### Technical Analysis The Skill instructs the Agent's x402 client to sign USDC payments automatically after receiving HTTP 402 responses. It also directs the Agent to automatically follow `next_calls` values supplied by the remote launch service. No documented control limits payment amounts, aggregate expenditure, number of calls, polling frequency, retry count, payment recipient, destination origin, redirects, or permitted endpoint paths. There is also no requirement for explicit user confirmation before signing a payment. Consequently, a remote response influences both which requests are made and which payment challenges are processed. If the external service is compromised, malicious, or incorrectly configured, it could supply excessive or unauthorized follow-up calls. Those calls could return payment challenges that the client signs and retries automatically. ### Attack Path 1. The Agent polls the documented `/crypto/launches` endpoint. 2. A compromised, malicious, or faulty remote service returns launch records containing attacker-controlled or excessive `next_calls`. 3. Following the Skill's instruction, the Agent automatically chains those calls without obtaining user approval. 4. The selected endpoints return HTTP 402 payment challenges. 5. The x402 client signs USDC payments on Base and retries the requests. 6. Repeated follow-u ...[truncated 712 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user confirmation before every paid request, showing the amount, asset, network, recipient, destination endpoint, and cumulative session expenditure. 2. Enforce strict per-call, per-session, and daily spending limits in the payment client rather than relying only on Skill instructions. 3. Do not execute arbitrary `next_calls` URLs. Parse them as untrusted data and reconstruct requests from validated token identifiers. 4. Allowlist the exact HTTPS origin and permitted endpoint paths. Reject alternate schemes, hosts, ports, embedded credentials, and unapproved query parameters. 5. Disable cross-origin redirects and validate the final destination after every redirect. 6. Validate each HTTP 402 challenge, including payment amount, token contract, chain ID, recipient, expiration, and replay protection. 7. Apply maximum call-chain depth, retry limits, request-count limits, polling intervals, timeouts, and circuit breakers. 8. Present a dry-run plan before chained operations and require renewed approval when the destination or cumulative cost changes. 9. Log every payment authorization and provide an immediate cancellation mechanism.