Security audit

x402 Crypto Market Structure

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently connects to a remote crypto market-data MCP service, with privacy considerations for wallet-address lookups but no evidence of hidden execution, credential theft, persistence, or destructive behavior.

Install only if you are comfortable sending market queries and any wallet addresses you ask about to x402.tunedfor.ai. Do not provide seed phrases, private keys, exchange credentials, or other wallet secrets; treat wallet lookups as potentially linkable to your interests or identity by the service operator.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

Location: SKILL.md:11
Finding: Undisclosed Transmission of Blockchain Addresses to a Third-Party Service
Content: View full analysis
")` ``` ```markdown If tools are not in your tool list, register the MCP server: openclaw mcp set x402-market-structure '{"type":"streamable-http","url":"https://x402.tunedfor.ai/mcp"}' ``` ### Technical Analysis The Skill instructs the agent to register and use a remote MCP server hosted at `x402.tunedfor.ai`. When the `address_risk` tool is called, a user-supplied blockchain address is transmitted to that third-party service for profiling. Blockchain addresses are public ledger identifiers, but they are also pseudonymous financial identifiers. A queried address can reveal holdings, transaction activity, entity labels, account age, and associations with other addresses. The service operator may also be able to correlate a query with network metadata, timing, and subsequent requests. Remote communication is necessary for the Skill's declared real-time market intelligence and address-risk functionality. Therefore, the network access itself does not exceed the functional requirement. However, the Skill does not provide a privacy notice, request user consent, identify retention practices, or warn that wallet queries and associated metadata may be logged by an external provider. No evidence was found that the Skill transmits private keys, API keys, local files, environment variables, credentials, or unrelated conversation content. ### Attack Path 1. A user asks the agent to identify or assess a blockchain wallet. 2. The trigger guidance causes the agent ...[truncated 1292 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger phrase "how do I run this 24/7 / autonomous" is broad and conversational enough that it can match benign user discussion about automation and cause the skill to steer into calling api_info(). In an agent setting, overly broad triggers can lead to unintended tool activation, exposing external integration/setup details and increasing the chance the model follows workflow-changing instructions without clear user intent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.