T09 · Insecure Skill Coding Practices
- Location
SKILL.md:49- Finding
Remote Payment Challenge Is Signed Without Mandatory Validation or User Confirmation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 49–51
Vulnerability Type: Unvalidated transaction authorization
Risk Level: HighRelevant snippet:
markdown 1. `GET` any endpoint unpaid -> HTTP 402 + `PAYMENT-REQUIRED` header (base64 JSON challenge) 2. Decode, sign with a USDC(Solana) wallet per the challenge, retry with `X-PAYMENT` header 3. Facilitator verifies + settles on-chain; you get 200 + the data (no custodian, no key escrow)Technical Analysis
The skill directs an agent to decode and sign payment terms supplied by a remote API. Although advertised prices, a USDC mint, a payment recipient, and a facilitator are documented elsewhere in
SKILL.md, the payment procedure does not require the agent to verify the challenge against those declared values.In particular, there is no mandatory check for:
- The expected payment amount for the selected endpoint
- The documented recipient address
- The documented USDC mint and Solana mainnet
- The expected facilitator
- Challenge expiration or replay constraints
- A user-approved maximum payment
- Explicit user confirmation before signing
The remote service operator controls the
PAYMENT-REQUIREDresponse. Consequently, remotely supplied transaction terms cross the wallet-authorization boundary and are signed without a documented validation gate. This is a reachable authorization flaw when an agent follows the instructions with access to a funded, signing-capable wallet.Attack Path
- A user asks the agent to query one of the paid carry-intelligence endpoints.
- The agent sends an unpaid request and receives an HTTP 402 response.
- A compromised or dishonest endpoint returns a syntactically valid payment challenge whose amount, recipient, mint, network, or other terms differ from the advertised terms.
- Following
SKILL.md, the agent decodes and signs the challenge without mechanically checking those fields or ob ...[truncated 818 chars]
- Remediation
View remediation
Remediation Suggestions
Before signing, require the client to parse and validate every payment challenge against a strict policy:
- Map each endpoint to an exact maximum price and reject challenges above that amount.
- Allow only the documented recipient address, USDC mint, Solana mainnet, and facilitator.
- Bind the challenge to the intended endpoint and request.
- Validate expiration, nonce, and replay-protection fields.
- Reject missing, malformed, ambiguous, or unexpected transaction fields.
- Display the amount, asset, network, and recipient and require explicit user confirmation before each payment.
- Enforce wallet-level per-transaction and cumulative spending limits.
- Treat redirects as untrusted and never forward payment authorization to a different origin.
- Document a fail-closed rule: any mismatch between the challenge and the advertised payment policy must abort the operation.