cpbox-news-search

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:48 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent paid news-search integration, but it asks users to run an unpinned payment package for automatic wallet-signed payments.

Review this skill before installing or using it for payments. Use a pinned, trusted version of the x402 payment client, verify payment destination, network, asset, and amount before signing, and avoid running the payment command in an environment with unnecessary secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:65

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 65–69
Vulnerability Type: Supply-chain risk from an unpinned executable dependency
Risk Level: Medium

Vulnerable Code

bash

npx @springmint/x402-payment \
  --url https://www.cpbox.io/api/x402/news-search \
  --method GET

Technical Analysis

The documented command instructs users to execute @springmint/x402-payment through npx without specifying an exact package version or integrity hash. If the package is absent locally, npx may retrieve and immediately execute the version currently resolved by the configured npm registry.

Because neither a lockfile nor an immutable version is provided, the code executed by a user can differ from the code reviewed when this skill was published. Possible compromise vectors include takeover of the package or maintainer account, publication of a malicious package update, or use of a compromised or attacker-controlled package registry.

The package is used in an x402 cryptocurrency payment workflow involving local EIP-712 signing. Although the audited file does not contain credentials or executable malicious code, executing an unreviewed package in this context creates an elevated supply-chain risk because the process may interact with wallet-signing facilities.

Attack Path

1. An attacker compromises the npm package, its maintainer account, or the registry source used by the victim.
2. The attacker publishes a malicious version of @springmint/x402-payment.
3. A user follows the command documented in SKILL.md.
4. npx resolves, downloads, and executes the malicious package because no exact audited version is specified.
5. The package runs with the permissions of the invoking user and may inspect accessible local data, manipulate payment requests, or abuse wallet integrations exposed to the process.

Impact Assessment

Successful exploitation permits arbitrary code execution with the p ...[truncated 586 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version, for example @springmint/x402-payment@X.Y.Z, rather than allowing mutable resolution.
2. Install the dependency through a committed lockfile and use deterministic installation such as npm ci.
3. Verify package integrity and provenance using registry integrity metadata, signatures, attestations, or a trusted internal artifact mirror.
4. Prefer executing a reviewed local installation over downloading and executing code on demand with npx.
5. Document the package's required filesystem, network, environment-variable, and wallet permissions.
6. Run the payment client in a restricted environment with minimal filesystem access and no unnecessary secrets.
7. Isolate wallet signing from the package process and require explicit user confirmation of the destination, asset, network, amount, and typed data before every signature.
8. Establish a controlled dependency-update process that includes source review, malware scanning, and testing before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The documentation instructs users to execute npx @springmint/x402-payment without pinning an exact package version. This can cause users to fetch and run whatever version is latest at execution time, creating a supply-chain risk if a malicious or compromised release is published. Because npx executes downloaded package code, the impact is higher than a passive dependency reference.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.