Security audit

x402-development

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only x402 payments skill that matches its stated purpose, but users should treat its wallet and private-key examples as real-money sensitive.

Installers should read this as real payment integration guidance: use testnets or low-balance dedicated wallets, avoid primary wallet keys in agent environments, store secrets in a vault or managed wallet service, add confirmation and spend-policy gates for autonomous flows, and only trust known facilitator endpoints.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The documentation explicitly requires clients to sign payments with a NEAR full-access key, which grants account-wide authority far beyond a single token transfer. In the context of an agent payment flow, compromise of the client environment, SDK misuse, or malicious downstream code could turn a micropayment action into complete account takeover and unauthorized transfers.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The buyer example reads a raw private key from an environment variable and immediately registers it for automatic payment signing, but the skill does not place an explicit warning nearby that this key controls spendable funds and must be limited, protected, and preferably used only on testnet. In an agent or MCP context, this increases the chance that developers copy the pattern into unattended systems where requests can trigger real on-chain payments without sufficient operator awareness or spending controls.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The example shows a full-access private key being loaded from an environment variable but does not clearly warn that this key can control the entire NEAR account, not just authorize a single payment. Developers integrating agentic or server-side payment flows may normalize handling a highly sensitive secret without adopting stronger isolation, increasing the chance of account compromise through logs, process leaks, CI exposure, or prompt/agent abuse.

Missing User Warnings

Medium

Confidence: 76% confidence
Finding: This self-facilitation example wires a live signing key into code paths that can submit on-chain transactions, which materially increases risk if readers copy it into production without understanding custody, authorization, and environment separation requirements. In the context of a payments SDK spanning multiple chains, examples that directly connect signing and settlement logic can lead to fund loss or unintended transaction execution if the key is mishandled or the setup is deployed broadly.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: The self-hosted facilitator example shows direct use of a facilitator private key for settlement operations without warning about key custody or the financial blast radius of compromise. Because this skill is specifically about internet-native payments and facilitator-hosted verify/settle endpoints, omission of that warning makes misuse more dangerous than in generic sample code: operators may unknowingly deploy a service that can move funds using a hot key.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation states that `extra.facilitatorAddress` is fetched from the facilitator's remote `GET /supported` response and that only this address can call `settle()`, but it does not prominently warn users that trusting this remote value effectively delegates charge authority to whoever controls that endpoint. In a payment authorization flow, this omission can mislead integrators into assuming the field is routine metadata rather than a security-critical trust anchor, increasing the risk of overcharging or settlement by an unexpectedly controlled facilitator.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/lifecycle-hooks.md:74