T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:417- Finding
Automatic x402 Payments Lack Documented Approval and Spending Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
Sponge Wallet
Security checks for vulnerabilities and agentic risk
Overview
This doc-only wallet skill is not plainly malicious, but it gives agents broad real-money authority including transfers, trading, Amazon checkout, and automatic paid fetches without enough user-control guidance.
Review this carefully before installing. Only use it with low-balance or tightly scoped API keys, prefer testnet, restrict credential-file permissions, avoid broad SPONGE_API_KEY exports, and require explicit human confirmation before any transfer, trade, bridge, withdrawal, non-dry-run checkout, or x402 paid fetch. Treat x402 URLs and Amazon checkout inputs as high-risk because they can spend funds or place orders through the agent.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:55- Finding
Financial Bearer Credential Is Persisted in a Plaintext File Without Enforced Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (18)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md POST /api/polymarket -> Polymarket prediction market trading POST /api/checkout -> Amazon checkout (initiate purchase) GET /api/checkout/:sessionId -> checkout status DELETE /api/checkout/:sessionId -> cancel checkout GET /api/checkout/history -> checkout history POST /api/checkout/amazon-search -> search Amazon products
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
GET /api/checkout/history -> checkout history POST /api/checkout/amazon-search -> search Amazon products
Rules: use register (agents), never login | store key in ~/.spongewallet/credentials.json | requests are JSON Errors: HTTP status + JSON error message
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
GET /api/checkout/history -> checkout history POST /api/checkout/amazon-search -> search Amazon products
Rules: use register (agents), never login | store key in ~/.spongewallet/credentials.json | requests are JSON Errors: HTTP status + JSON error message
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
GET /api/checkout/history -> checkout history POST /api/checkout/amazon-search -> search Amazon products
Rules: use register (agents), never login | store key in ~/.spongewallet/credentials.json | requests are JSON Errors: HTTP status + JSON error message
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
GET /api/checkout/history -> checkout history POST /api/checkout/amazon-search -> search Amazon products
Rules: use register (agents), never login | store key in ~/.spongewallet/credentials.json | requests are JSON Errors: HTTP status + JSON error message
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
GET /api/checkout/history -> checkout history POST /api/checkout/amazon-search -> search Amazon products
Rules: use register (agents), never login | store key in ~/.spongewallet/credentials.json | requests are JSON Errors: HTTP status + JSON error message
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
GET /api/checkout/history -> checkout history POST /api/checkout/amazon-search -> search Amazon products
Rules: use register (agents), never login | store key in ~/.spongewallet/credentials.json | requests are JSON Errors: HTTP status + JSON error message
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
GET /api/checkout/history -> checkout history POST /api/checkout/amazon-search -> search Amazon products
Rules: use register (agents), never login | store key in ~/.spongewallet/credentials.json | requests are JSON Errors: HTTP status + JSON error message
text
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documented operations include transfers, swaps, bridges, withdrawals, trading, and checkout-related actions, but the guide does not prominently warn that these may irreversibly spend assets or execute real financial transactions. In a user-invocable agent skill, weak safety prompts increase the chance of accidental or socially engineered asset loss.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill includes a generic remote-fetch primitive that accepts an arbitrary URL and can attach payment behavior, which is much broader than necessary for wallet management. In an agent setting, this creates a powerful SSRF-like/exfiltration/payment gadget: an attacker can steer the agent to contact third-party endpoints and potentially spend wallet funds automatically.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The checkout section mentions dryRun as an option but does not clearly emphasize that setting dryRun to false can place an actual Amazon order. Because checkout is asynchronous and looks similar to a preview flow, users or higher-level agents may unintentionally trigger real purchases.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The x402 flow explicitly states it can automatically create and sign a USDC payment and retry the request, but the warning about automatic spending is not prominent where the feature is introduced. This makes the feature especially risky because a seemingly simple fetch can silently become a paid transaction to an attacker-chosen service.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest presents a wallet API skill, but it also exposes x402_fetch, a generic paid remote-fetch capability to arbitrary services. That meaningfully broadens the trust boundary from wallet operations to general outbound requests with automatic payment, which can be abused to exfiltrate data to third parties or spend funds on unintended services.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest frames the skill as wallet management, but the file also documents Amazon purchasing flows that can trigger real-world spending outside the stated scope. This scope expansion is dangerous because agents or reviewers may grant trust and permissions appropriate for a finance skill without realizing it also enables e-commerce purchases.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Why the steps matter (short rationale) - **Register vs login**: agents create a new managed wallet tied to a human owner. That owner must explicitly claim the agent. Login is only for humans who already have an account. - **Claim URL**: ensures the human owner explicitly links the agent to their account and controls allowlists/funding. - **Credential persistence**: the `apiKey` is returned once (immediately for agent-first mode, or after device approval for standard mode). If you lose it, you must re-register or re-authenticate.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1 — Start registration (agent-first recommended)
bash curl -sS -X POST "$SPONGE_API_URL/api/agents/register" \ -H "Content-Type: application/json" \ -d '{ "name":"YourAgentName",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
1) Register (agents only)
bash curl -sS -X POST "$SPONGE_API_URL/api/agents/register" \ -H "Content-Type: application/json" \ -d '{ "name":"YourAgentName",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
Unlike the API registration examples, this external transmission is to an arbitrary third-party URL via x402_fetch, not just the declared wallet backend. That broad outbound capability expands the attack surface by enabling third-party communication and paid requests under wallet credentials and funds.
- Content
md -H "Authorization: Bearer $SPONGE_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "url":"https://api.paysponge.com/api/services/purchase/svc_abc123/polymarket/markets?search=bitcoin&limit=5", "method":"GET", "preferred_chain":"base" }'
Static analysis
No suspicious patterns detected.