Security checks for vulnerabilities and agentic risk
Overview
This skill appears purpose-aligned, but it asks for a wallet private key and passes it to unpinned code downloaded at runtime, so users should review it carefully before installing.
Install only if you are comfortable giving a third-party npm package access to a dedicated, low-balance Base wallet key. Do not use a primary wallet key; avoid project-directory config files; apply strict file permissions if you use plaintext storage; and prefer a pinned, reviewed package version or safer wallet/signing flow.
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T03 · Remote Payload Retrieval and Execution
Error
Location
scripts/analyze.sh:47
Finding
Unpinned npm Package Is Downloaded and Executed with Access to a Wallet Private Key
Content
View full analysis
Vulnerability Details
File Location: scripts/analyze.sh, lines 25 and 47 Vulnerability Type: Unpinned runtime dependency and remote code execution through npx Risk Level: High
Vulnerable Code
bash
if [ -n "$PRIVATE_KEY" ]; then
export X402_PRIVATE_KEY="$PRIVATE_KEY"
break
fi
bash
# Execute the market analysis
npx -y @itzannetos/x402-tools-claude alpha-finder "$QUERY"
Technical Analysis
The script exports a cryptocurrency wallet private key into its environment and subsequently invokes an npm package through npx -y. No exact package version, lockfile, integrity hash, or locally reviewed package source is provided.
Consequently, npx can retrieve and execute whichever package version the npm registry resolves at execution time. The -y option suppresses the normal installation confirmation. The downloaded package inherits the script's environment, including X402_PRIVATE_KEY, and executes with the operating-system privileges of the user running the skill.
This creates both a remote-payload and software-supply-chain trust boundary. Although the audited repository does not contain direct key-exfiltration code, a compromised package release, npm maintainer account, transitive dependency, or registry resolution could alter the effective payload after this skill has been reviewed.
Attack Path
An attacker compromises the npm package, its maintainer account, a transitive dependency, or the applicable package-resolution path.
The attacker publishes code that reads X402_PRIVATE_KEY, signs unauthorized transactions, transmits the key, or executes arbitrary local commands.
A user invokes scripts/analyze.sh with a market query.
The script reads and exports the wallet private key.
npx -y downloads and executes the attacker-controlled package version without interactive confirmation.
The package inherits the wallet key and the invoking use
...[truncated 823 chars]
Remediation
View remediation
Remediation Suggestions
Pin the dependency to an exact, reviewed version rather than relying on the registry's current resolution:
bash
Verify the package's actual executable name before adopting this example.
Commit a package manifest and lockfile, and install dependencies using a reproducible command such as npm ci.
Verify dependency integrity and provenance. Review the pinned package and its transitive dependencies before exposing any financial secret to them.
Prefer vendoring or locally installing reviewed source instead of downloading executable code during every invocation.
Do not provide a general-purpose or high-value wallet private key to third-party package code.
Use a dedicated, low-balance wallet with only the funds required for expected request fees.
Prefer an audited local signing service or hardware-backed signer that approves narrowly scoped transactions without disclosing the raw private key.
Execute the dependency in a restricted environment with minimal filesystem access, a sanitized environment, and limited network access where operationally possible.
Document the package version and re-audit all dependency updates before deployment.
T09 · Insecure Skill Coding Practices
Warning
Location
SKILL.md:28
Finding
Documentation Recommends Plaintext Wallet-Key Storage Without Enforcing Restrictive Permissions
Content
View full analysis
Vulnerability Details
File Location: SKILL.md, lines 28-35 Vulnerability Type: Insecure storage of a cryptocurrency private key Risk Level: Medium
The documentation also permits a configuration file in the current working directory:
text
1. Current directory: ./x402-config.json
2. Home directory: ~/.x402-config.json
3. Working directory: $PWD/x402-config.json
Technical Analysis
The recommended command stores a wallet private key in a plaintext JSON file without explicitly setting restrictive file permissions. The resulting permissions depend on the user's current umask. In an environment with a permissive umask, other local accounts or processes may be able to read the key.
Permitting the same secret file in a project or working directory also increases the likelihood that it will be indexed, copied into build contexts, included in backups, uploaded as an artifact, or accidentally committed to version control.
The script does not validate file ownership or permissions before reading a discovered configuration file. This finding does not establish that the key is necessarily exposed on every system; exploitation depends on actual permissions, local access, and surrounding tooling.
Attack Path
A user follows the documented setup command or creates x402-config.json in a project directory.
The file receives permissions derived from a permissive umask, or project tooling copies or tracks the file.
Another local user, process, backup consumer, artifact recipient, or repository collaborator gains access to the plaintext file.
The party extracts the private_key value.
The stolen key is used to impersonate the wallet owner and authorize transactions supported by that wallet.
Impact Assessment
Disclosure grants possession of the raw cryptocurrency private key. An attacke
...[truncated 409 chars]
Remediation
View remediation
Remediation Suggestions
Replace the documented creation command with one that enforces owner-only access:
bash
The skill instructs users to place a blockchain private key in an environment variable or plaintext JSON file, including a recommended persistent location in the home directory, without warning that this credential grants spending authority. This increases the chance of key theft through shell history, overly permissive file permissions, backups, logs, or accidental inclusion in source-controlled working directories, which could lead to unauthorized wallet use and payment fraud.
Content
No source excerpt is available for this finding.
Session Persistence
Medium
Category
Rogue Agent
Confidence
92% confidence
Finding
The recommended use of ~/.x402-config.json creates long-lived session/payment credential persistence in plaintext, making compromise more likely across sessions and unrelated projects. Because this skill performs paid requests on Base via x402, theft of the stored private key can directly enable unauthorized charges and wallet abuse, so the market-research context makes the persistence more dangerous than a non-financial API token.
Content
Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
Home directory: ~/.x402-config.json ← Recommended
Working directory: $PWD/x402-config.json
Create the config file:
json
{
"private_key": "0x1234567890abcdef..."
Context-Inappropriate Capability
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The script reads a private blockchain payment key from disk or environment and exports it for use by a downstream tool, creating direct access to a sensitive credential. In the context of a market-research skill, this is especially risky because the skill’s primary purpose is analysis, while secret-handling and payment signing materially increase the blast radius if the called package or execution environment is compromised.
Content
No source excerpt is available for this finding.
Session Persistence
Medium
Category
Rogue Agent
Confidence
82% confidence
Finding
The script instructs users to store a long-lived private key in the current directory or home directory, creating persistent local secret material that may be unintentionally exposed through backups, repository inclusion, weak file permissions, or later compromise of the host. For a skill that users may run casually for market research, encouraging durable credential storage increases the chance of broad, repeated misuse if that key is discovered.
Content
Scanner excerpt · scripts/analyze.sh (reported line 40)May include surrounding context.
sh
echo ""
echo "Please configure your private key using one of these methods:"
echo "1. Set environment variable: export X402_PRIVATE_KEY=\"0x...\""
echo "2. Create x402-config.json in current directory with:"
echo ' {"private_key": "0x..."}'
echo "3. Create ~/.x402-config.json in your home directory"
exit 1
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The script executes an npm package directly via npx without pinning an exact version, so each run may fetch whatever version is current at execution time. Because this script also loads and exports a blockchain private key into the environment, a compromised or malicious upstream package update could immediately access that key and exfiltrate it or spend funds.
