Security audit

Ordiscan

Security checks for vulnerabilities and agentic risk

Overview

The skill is clearly for Ordiscan x402 payments, but it asks agents to handle raw wallet keys and sign USDC transfer authorizations without enough local validation or spending controls.

Review carefully before installing. Only use this with a dedicated low-balance wallet, verify every payment amount and recipient out of band, avoid exposing a primary private key through X402_PRIVATE_KEY or ~/.evm-wallet.json, and prefer pinned, reviewed dependencies or a wallet flow that enforces a hard maximum spend.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/x402-sign.mjs:76
Finding: Untrusted Payment Headers Can Authorize Arbitrary USDC Transfers
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: package.json:6
Finding: Unpinned Dependencies and Runtime Package Execution Create Supply-Chain Risk
Content: View full analysis
``` ```bash # Check if awal is already available and authenticated which awal && npx awal status ``` ```bash npx awal x402 pay "https://api.ordiscan.com/v1/inscription/0" ``` ### Technical Analysis The project declares `viem` using the broad semver range `^2.0.0` and does not include an audited lockfile. Following the documented `npm install` command can consequently resolve a newer package graph than the one originally reviewed. The instructions also execute `npx awal` without an exact version or a restriction such as `--no-install`. Depending on the local npm/npx behavior and whether the package is already installed, this may download and execute mutable package content from the configured registry. This is particularly sensitive because the resulting packages run in a workflow that has access to wallet credentials, payment data, and the user's local environment. ### Attack Path 1. A user follows the documented setup or alternative-wallet instructions. 2. `npm install` resolves `viem` and transitive dependencies using mutable semver and registry metadata because no lockfile fixes the dependency graph. 3. Alternatively, `npx awal` downloads a package when a trusted local executable is unavailable. 4. A compromised maintainer release, registry account, dependency, or substituted registry response supplies malicious package content. 5. Package installation hooks or the invoked CLI execute locally under the user's account. 6. The malicious code can inspect environment variables and local files ...[truncated 497 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:62
Finding: Predictable Shared Temporary File Permits Symlink and Collision Attacks
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The skill instructs the agent to read an Ethereum private key from X402_PRIVATE_KEY or ~/.evm-wallet.json, exposing highly sensitive signing material to the skill execution environment. Even if the key is intended only for local signing, expanding skill access to raw private keys materially increases the risk of theft, misuse, or accidental disclosure through logs, subprocesses, or compromise of related tooling.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
Requires node and the X402_PRIVATE_KEY environment variable (an Ethereum private key with USDC on Base).

If X402_PRIVATE_KEY is not already set, check if ~/.evm-wallet.json exists (created by the evm-wallet skill). If it does, read the private key from it:

bash
X402_PRIVATE_KEY=$(node -e "console.log(JSON.parse(require('fs').readFileSync(require('os').homedir()+'/.evm-wallet.json','utf8')).privateKey)")

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill uses sensitive capabilities, including reading environment variables and a wallet file containing a private key, but does not declare a restrictive tool scope. This weakens containment and makes it harder for a host/runtime to enforce least privilege around credential access and command execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: Using npx awal without a pinned version allows whatever package version is currently resolved to be fetched and executed. This creates a supply-chain risk where a compromised or unexpected upstream release could execute arbitrary code in the agent environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: Using npx awal without a pinned version allows whatever package version is currently resolved to be fetched and executed. This creates a supply-chain risk where a compromised or unexpected upstream release could execute arbitrary code in the agent environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: Using npx awal without a pinned version allows whatever package version is currently resolved to be fetched and executed. This creates a supply-chain risk where a compromised or unexpected upstream release could execute arbitrary code in the agent environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: Using npx awal without a pinned version allows whatever package version is currently resolved to be fetched and executed. This creates a supply-chain risk where a compromised or unexpected upstream release could execute arbitrary code in the agent environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: Using npx awal without a pinned version allows whatever package version is currently resolved to be fetched and executed. This creates a supply-chain risk where a compromised or unexpected upstream release could execute arbitrary code in the agent environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: Using npx awal without a pinned version allows whatever package version is currently resolved to be fetched and executed. This creates a supply-chain risk where a compromised or unexpected upstream release could execute arbitrary code in the agent environment.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
CONTENT=$(echo -n "Hello from OpenClaw!" | base64) BODY="{\"contentType\":\"text/plain\",\"base64_content\":\"$CONTENT\",\"recipientAddress\":\"bc1p...\"}" HEADER=$(curl -s -o /tmp/x402_body.json -w '%header{Payment-Required}' \ -X POST -H "Content-Type: application/json" \ -d "$BODY" \ "https://api.ordiscan.com/v1/inscribe")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
HEADER=$(curl -s -o /tmp/x402_body.json -w '%header{Payment-Required}'
-X POST -H "Content-Type: application/json"
-d "$BODY"
"https://api.ordiscan.com/v1/inscribe")

text
Check the price before paying:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
HEADER=$(curl -s -o /tmp/x402_body.json -w '%header{Payment-Required}'
-X POST -H "Content-Type: application/json"
-d "$BODY"
"https://api.ordiscan.com/v1/inscribe")

text
Check the price before paying:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
HEADER=$(curl -s -o /tmp/x402_body.json -w '%header{Payment-Required}'
-X POST -H "Content-Type: application/json"
-d "$BODY"
"https://api.ordiscan.com/v1/inscribe")

text
Check the price before paying:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
HEADER=$(curl -s -o /tmp/x402_body.json -w '%header{Payment-Required}'
-X POST -H "Content-Type: application/json"
-d "$BODY"
"https://api.ordiscan.com/v1/inscribe")

text
Check the price before paying:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.
HEADER=$(curl -s -o /tmp/x402_body.json -w '%header{Payment-Required}'
-X POST -H "Content-Type: application/json"
-d "$BODY"
"https://api.ordiscan.com/v1/inscribe")

text
Check the price before paying:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.
HEADER=$(curl -s -o /tmp/x402_body.json -w '%header{Payment-Required}'
-X POST -H "Content-Type: application/json"
-d "$BODY"
"https://api.ordiscan.com/v1/inscribe")

text
Check the price before paying:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.
HEADER=$(curl -s -o /tmp/x402_body.json -w '%header{Payment-Required}'
-X POST -H "Content-Type: application/json"
-d "$BODY"
"https://api.ordiscan.com/v1/inscribe")

text
Check the price before paying:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.
HEADER=$(curl -s -o /tmp/x402_body.json -w '%header{Payment-Required}'
-X POST -H "Content-Type: application/json"
-d "$BODY"
"https://api.ordiscan.com/v1/inscribe")

text
Check the price before paying:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.
HEADER=$(curl -s -o /tmp/x402_body.json -w '%header{Payment-Required}'
-X POST -H "Content-Type: application/json"
-d "$BODY"
"https://api.ordiscan.com/v1/inscribe")

text
Check the price before paying:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.
HEADER=$(curl -s -o /tmp/x402_body.json -w '%header{Payment-Required}'
-X POST -H "Content-Type: application/json"
-d "$BODY"
"https://api.ordiscan.com/v1/inscribe")

text
Check the price before paying:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 298)May include surrounding context.
HEADER=$(curl -s -o /tmp/x402_body.json -w '%header{Payment-Required}'
-X POST -H "Content-Type: application/json"
-d "$BODY"
"https://api.ordiscan.com/v1/inscribe")

text
Check the price before paying:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.
md
BODY="{\"contentType\":\"text/plain\",\"base64_content\":\"$CONTENT\",\"recipientAddress\":\"bc1p...\"}" # Step 1: Get price and payment header HEADER=$(curl -s -o /tmp/x402_body.json -w '%header{Payment-Required}' \ -X POST -H "Content-Type: application/json" \ -d "$BODY" \ "https://api.ordiscan.com/v1/inscribe")

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency version for viem is specified with a caret range (^2.0.0), which permits automatic installation of newer minor and patch releases. This can introduce supply-chain risk if a later allowed version contains a malicious change or breaking security regression, reducing build reproducibility and making it harder to audit exactly what code is deployed.
Content: Scanner excerpt · package.json (reported line 6)May include surrounding context.
json
"private": true, "type": "module", "dependencies": { "viem": "^2.0.0" } }

Static analysis

No suspicious patterns detected.