Security audit
x402 Lotto
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent x402 lottery client, but it enables wallet-backed USDC ticket purchases without clear spending limits, price checks, or user confirmation safeguards.
Review before installing. Use only a dedicated low-balance or test wallet, verify the x402.lotto service and @x402/evm dependency, require visible pricing and explicit confirmation before any ticket purchase or USDC payment, and confirm lottery participation is legal in your location.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.