x402 Paywall

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:46 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent payment-layer prototype, but its core payment verification and automatic payment behavior are unsafe for real-money use without careful review.

Do not install this for production or autonomous real-money payments unless payment verification is fixed to validate the actual USDC transfer details, dependencies fail closed, transaction replay is durable, and automatic spending requires explicit approval and trusted recipients.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: src/paywall.py:92

Finding

Payment Verification Accepts Unrelated Successful Transactions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/paywall.py:85

Finding

Missing Requests Dependency Causes Fail-Open Payment Authentication

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/paywall.py:144

Finding

Replay Protection Is Process-Local and Non-Atomic

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:249

Finding

Installation Instructions Use Unpinned Third-Party Packages

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the verifier accepts generic transaction success or any well-formed tx hash in fallback mode rather than validating the specific USDC transfer details, an attacker can bypass payment by submitting an unrelated successful transaction hash. Because this skill is explicitly a payment gate, weak verification defeats the core security boundary and can enable unauthorized access to paid capabilities at scale.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the verifier accepts generic transaction success or any well-formed tx hash in fallback mode rather than validating the specific USDC transfer details, an attacker can bypass payment by submitting an unrelated successful transaction hash. Because this skill is explicitly a payment gate, weak verification defeats the core security boundary and can enable unauthorized access to paid capabilities at scale.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The verifier claims to perform on-chain USDC payment validation, but it only checks that a transaction receipt exists and that the transaction succeeded. It does not verify that the transaction interacted with the USDC contract, transferred funds to the expected recipient, came from the expected sender, or transferred the expected amount, so any unrelated successful transaction hash on the chain can unlock paid functionality.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

If the requests dependency is unavailable, the fallback treats any 66-character hex string beginning with 0x as a valid payment proof. This completely bypasses payment enforcement, allowing an attacker to fabricate a fake tx hash and receive paid service without sending funds.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill advertises code and operational capabilities involving environment access, file writing, and network use, but does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, this increases the risk of over-privileged execution because consumers cannot accurately assess what the skill may access or transmit before enabling it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The client example emphasizes automatic payment handling for real USDC transfers without a prominent warning, confirmation step, or safer dry-run pattern. In agentic environments, this can lead to unintended autonomous spending if users copy the example directly or if higher-level agents invoke it without strong purchase controls.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

# Call a paid skill — handles payment automatically
result = client.call(
    url="https://api.example.com/api/analyze",
    method="POST",
    json={"metrics": {...}},
    max_price=0.10  # Won't pay more than $0.10

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

subscription_price=9.99, # $9.99/month subscription_duration_days=30 )

Subscribers get unlimited calls for the period

text

## Ledger

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes a meta-skill that wraps other skills with per-call pricing and on-chain payment verification, but this file implements a standalone local ledger with revenue analytics, payer history lookup, subscription management, and CSV export. Those operations are broader product capabilities than simply charging per call and verifying payment, so the code behavior exceeds the manifest's stated scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The module can export full payment records, including payer identifiers and transaction metadata, to an arbitrary filesystem path without any access control or path restrictions. In an agent skill context, if untrusted callers can influence the output path or trigger exports, this creates a data exfiltration channel and can overwrite files accessible to the process.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/paywall.py (reported line 98)May include surrounding context.

python

"id": 1,
        }
        try:
            resp = requests.post(self.rpc_url, json=payload, timeout=10)
            receipt = resp.json().get("result")
            if not receipt or receipt.get("status") != "0x1":
                return False

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The client automatically sends on-chain payment after receiving a 402 response, with no explicit user confirmation step beyond a max_price threshold. In agent or autonomous workflows, this can cause unintended spending to arbitrary recipients returned by an endpoint, especially if the endpoint is malicious, compromised, or misconfigured.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.