T09 · Insecure Skill Coding Practices
- Location
SKILL.md:7- Finding
Automatic Cryptocurrency Payments Lack Explicit Approval and Spending Controls
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 7 and 143-172
Vulnerability Type: Automatic financial authorization without adequate consent, validation, or budget controls
Risk Level: MediumVulnerable Code
text All endpoints use x402 micropayments (USDC on Base). No API key required. Your agent pays per request automatically if you have an x402-compatible client.json { "x402Version": 1, "accepts": [{ "scheme": "exact", "network": "eip155:8453", "amount": "50000", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "payTo": "0xd3c3b0b35a9252f438ac3c86ca0ce18caa02ccab", "maxTimeoutSeconds": 60 }] }javascript import { createCdpAuthHeaders } from '@coinbase/x402'; const headers = createCdpAuthHeaders(apiKeyId, apiKeySecret); const authHeaders = await headers(); const response = await fetch( 'https://api.aitrencher.xyz/api/score-token?address=0x...', { headers: authHeaders.verify } );Technical Analysis
The Skill instructs an x402-compatible client to pay USDC automatically when invoking a third-party token-intelligence API. Locally held Coinbase CDP credentials are used to generate authorization headers, which are then sent to
api.aitrencher.xyz.The reviewed content does not transmit the raw
apiKeyIdorapiKeySecret, so direct credential exfiltration is not established. Nevertheless, the generated header is sensitive because it authorizes a financial operation.The instructions do not require:
- Explicit user approval before each payment.
- A per-request or cumulative spending limit.
- Rate limiting for automated calls.
- Client-side allowlisting of the destination host and payment recipient.
- Verification that the chain, token contract, amount, and payee in the HTTP 402 response match trusted values.
- Duplicate-payment prevention during retries.
- Defined validation of nonce, expiration, and replay protection.
Network payment authorization is relevant t ...[truncated 1752 chars]
- Remediation
View remediation
Remediation Suggestions
- Disable automatic payment by default and require explicit, informed user approval before each transfer.
- Display the destination host, recipient wallet, network, asset, exact amount, and purpose before approval.
- Enforce strict per-request, per-session, and daily spending limits independent of server-provided payment terms.
- Pin and validate all payment parameters before signing:
- Host:
api.aitrencher.xyz - Network: Base Mainnet,
eip155:8453 - Asset: approved USDC contract
- Recipient: explicitly trusted wallet
- Amount: no greater than the documented endpoint price
- Nonce, expiration, and request binding: valid and unique
- Host:
- Reject redirects and any unexpected changes to the host, payee, asset, chain, or price.
- Add rate limits and require renewed approval when an automation threshold is reached.
- Implement idempotency controls so retries cannot create duplicate payments.
- Store signing credentials in a secret manager or protected wallet service; never expose them to Skill text, model context, logs, URLs, or third-party servers.
- Treat generated authorization headers as secrets and ensure they are neither logged nor reusable.
- Document revocation, timeout, replay-protection, retry, and payment-failure behavior.
- Use a dedicated low-balance wallet with narrowly scoped permissions rather than a primary wallet.