T09 · Insecure Skill Coding Practices
Error
- Location
packages/shared/src/policy/index.ts:49- Finding
Payment policy fails open for malformed, non-finite, or negative amounts
- Content
View full analysis
maxPerRequest) { if (policy.requireHumanApproval) { return { decision: "needs-human-approval", reason: `Amount ${amount} exceeds per-request limit of ${policy.maxPerRequest}`, }; } return { decision: "denied", reason: `Amount ${amount} exceeds per-request limit of ${policy.maxPerRequest}`, }; } // 6. Daily spend limit if (currentDailySpend + amountNum > maxDailySpend) { if (policy.requireHumanApproval) { return { decision: "needs-human-approval", reason: `Daily spend would be ${currentDailySpend + amountNum}, exceeding limit of ${policy.maxDailySpend}`, }; } return { decision: "denied", reason: `Daily spend would be ${currentDailySpend + amountNum}, exceeding limit of ${policy.maxDailySpend}`, }; } // 7. All checks passed return { decision: "approved" }; ``` ```typescript // packages/shared/src/policy/index.ts:172 dailySpend += parseFloat(amount); ``` ### Technical Analysis The amount in an x402 payment requirement is controlled by the remote e ...[truncated 1972 chars]- Remediation
View remediation