cpbox-web-search

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:32 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent paid web-search integration, but it asks users to run an unpinned payment package and documents precise location sharing without enough privacy warning.

Review the payment helper before running it, prefer an exact pinned version or lockfile-managed install, and only send precise latitude/longitude when location-specific results are necessary and the user has agreed to share that data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47

Finding

Unpinned Third-Party Payment Package Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:47-50
Vulnerability Type: Unpinned dependency execution through npx
Risk Level: Medium

Complete Code Snippet:

bash

npx @springmint/x402-payment \
  --url https://www.cpbox.io/api/x402/web-search \
  --method GET

Technical Analysis

The documented command invokes @springmint/x402-payment without an exact version, integrity hash, lockfile, or provenance-verification requirement. Depending on the local npm environment, npx can retrieve the current package release from the configured registry and execute it immediately.

This creates a supply-chain trust boundary that exceeds what is necessary to document a web-search API. The effective executable payload can change after the Skill has been reviewed. The risk is elevated because the package handles an x402 payment workflow involving EIP-712 signatures and may operate in an environment with access to wallet or payment capabilities.

No evidence establishes that the current package is malicious. The vulnerability is the unsafe, mutable dependency-execution pattern and its exposure to package compromise, publisher-account compromise, registry substitution, or malicious dependency updates.

Attack Path

1. An attacker compromises the npm package, its publisher account, a transitive dependency, or the registry resolution path.
2. The attacker publishes or serves a malicious release under the expected package name.
3. A user or agent follows the documented unversioned npx command.
4. npx resolves, downloads, and executes the attacker-controlled release under the invoking user's account.
5. The malicious process accesses data and capabilities available to that account, potentially including payment configuration or wallet interfaces, and may alter payment requests or execute arbitrary local actions.

Impact Assessment

Successful exploitation provides code execution with the privilege ...[truncated 718 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the unversioned package reference with an exact, security-reviewed version, such as @springmint/x402-payment@X.Y.Z.
• Install the dependency through a committed lockfile rather than downloading and executing the latest release implicitly.
• Publish and verify package integrity hashes and npm provenance or signed release attestations.
• Review and pin transitive dependencies where the packaging workflow permits.
• Run the payment client in a sandbox with minimal filesystem, environment-variable, and network access.
• Keep private keys and seed phrases outside the package process. Use a narrowly scoped wallet interface with explicit transaction limits and user confirmation.
• Document the expected recipient, network, asset, maximum charge, and verification steps before requesting a signature.
• Prefer a locally reviewed client artifact or a first-party implementation when payment signing is security-critical.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

The documentation tells users to execute an unpinned package via npx @springmint/x402-payment, which will fetch the latest published version at runtime. If the upstream package is compromised or a breaking/malicious version is released, users of the skill could run attacker-controlled code on their machines during payment setup or search usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents optional precise location headers, including latitude and longitude, but does not clearly warn that these values may expose sensitive user location to the remote service. In a web-search skill, encouraging transmission of exact geolocation can unnecessarily increase privacy risk, especially when text-based or no location data would suffice for many queries.

Content

No source excerpt is available for this finding.