Find People (x402)

• Verdict: Suspicious
• Confidence: High
• Analyzed: May 10, 2026, 8:08 PM
• Findings: 3
• Version: 1.0.0

Overview

The skill matches its paid OSINT purpose, but it requires a blockchain private key and runs an unpinned npm package with that key despite not declaring a credential.

Review this carefully before installing. If you use it, use a dedicated low-balance wallet, inspect or pin the npm package, avoid storing a main private key in plaintext config files, and approve each paid OSINT query intentionally.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

ConcernHigh Confidence

What this means

A wallet private key can authorize paid requests and potentially expose funds if the invoked package or environment is unsafe.

Why it was flagged

The script reads a wallet private key from local config and passes it as an environment variable to an external npm tool. This high-impact credential is not declared in the registry metadata.

Skill content

PRIVATE_KEY=$(jq -r '.private_key' "$CONFIG_FILE" ...); export X402_PRIVATE_KEY="$PRIVATE_KEY"; ... npx -y @itzannetos/x402-tools-claude find-people "$QUERY"

Recommendation

Use only a dedicated low-balance x402/Base wallet, avoid main-wallet private keys, declare the credential requirement clearly, and ensure the invoked package is audited before use.

ASI04: Agentic Supply Chain Vulnerabilities

ConcernHigh Confidence

What this means

If the npm package changes or is compromised, the agent may execute unreviewed code with access to the user's payment key.

Why it was flagged

The skill runs an unpinned npm package via npx -y at runtime. The package code is not included in the artifact review and will receive the payment private key through the environment.

Skill content

npx -y @itzannetos/x402-tools-claude find-people "$QUERY"

Recommendation

Pin the package version, provide an install spec or vendored/auditable code, and avoid exposing the private key to unreviewed runtime dependencies.

ASI02: Tool Misuse and Exploitation

NoteHigh Confidence

What this means

Repeated or unintended invocations could spend USDC, even though each request is low cost.

Why it was flagged

Each invocation performs a paid request. This is disclosed and aligned with the skill purpose, but users should notice the financial effect.

Skill content

The script:
- Executes OSINT research with payment handling
- Costs $0.15 USDC per request (Base network)

Recommendation

Confirm paid searches before running them and keep only a small balance in the wallet used for this skill.