cpbox-llm-context

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:42 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for paid web-grounding, but it documents automatic payment execution through an unpinned npx package and optional precise-location sharing without enough guardrails.

Review this before installing if the agent may make paid requests. Pin and vet the x402 payment client, use spending limits or explicit confirmation for paid calls, and avoid sending exact coordinates unless the user specifically wants location-aware results.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:91

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 91–93
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Complete Code Snippet:

bash

npx @springmint/x402-payment \
  --url "https://www.cpbox.io/api/x402/llm-context?q=rust+ownership&maximum_number_of_tokens=4096" \
  --method GET

Technical Analysis

The documented command invokes @springmint/x402-payment through npx without specifying an exact package version. Depending on the local npm environment, npx can retrieve and execute the package version currently resolved by the registry. The project provides no lockfile, integrity hash, vendored implementation, or other mechanism that binds this example to an audited package artifact.

This creates a mutable supply-chain execution path: the code that users execute may differ from the code available when the skill was reviewed. The exposure is particularly sensitive because the documentation states that this dependency automatically signs and settles x402 payments. There is no evidence in the reviewed file that the package is currently malicious; the finding concerns the unsafe, unpinned execution mechanism.

Attack Path

1. An attacker compromises the package publisher account, registry distribution path, or a future package release.
2. The attacker publishes a malicious version under the same package name.
3. A user follows the documented unversioned npx command.
4. npx resolves, downloads, and executes the attacker-controlled release.
5. Malicious installation or runtime code executes with the privileges of the user running the command.
6. That code may inspect accessible environment variables, files, wallet configuration, or payment-signing context and may initiate unauthorized operations within those privileges.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the invoking user's privileges. Th ...[truncated 477 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to a reviewed exact version, for example @springmint/x402-payment@X.Y.Z, rather than relying on the registry's current resolution.
• Install the dependency as part of a controlled project setup and commit the generated lockfile.
• Enforce package integrity verification and verify registry provenance, publisher identity, and release signatures where available.
• Review the resolved package, transitive dependencies, and lifecycle scripts before allowing access to payment credentials.
• Avoid one-shot remote package execution for payment-sensitive operations. Prefer a locally installed, audited binary invoked with options that prohibit implicit downloads.
• Disable dependency lifecycle scripts where operationally possible and execute the payment client in a sandbox with minimal filesystem, environment, wallet, and network access.
• Require explicit transaction limits and user confirmation before signing or settling payments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

GET Request

bash

curl -s "https://www.cpbox.io/api/x402/llm-context?q=tallest+mountains+in+the+world" \
  -H "Accept: application/json"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx @springmint/x402-payment without pinning an exact version. That allows execution of whatever package version is current at install time, creating a supply-chain risk if a malicious or compromised release is published.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly documents sending precise latitude/longitude and other location headers to an external service, but does not provide an explicit privacy warning, consent requirement, or minimization guidance. This can expose sensitive user location data to a third party and may create compliance and user-safety issues, especially for agentic systems that may forward context automatically.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The parameter table states that search_lang defaults to en, which establishes an English locale preference by default. The document does not indicate that users should choose or confirm language preference, nor does it justify why English should be forced as the default.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.