Find People (x402)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:58 AM UTC
• Version: 1.0.0

Overview

This skill has a coherent paid OSINT purpose, but it asks users to expose a wallet private key to long-lived plaintext storage and dynamically downloaded code.

Install only if you are comfortable using a dedicated low-balance wallet and running an unpinned third-party npm package with access to that wallet key. Prefer not to store the key in plaintext; if you do, restrict permissions and rotate or move funds if the key may already have been exposed.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/research.sh:47

Finding

Unpinned npm Package Is Remotely Retrieved and Executed

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/research.sh:15

Finding

Wallet Private Key Is Stored in Plaintext and Exported to Third-Party Code

Content

View full analysis

~/.x402-config.json ``` The script searches user-controlled filesystem locations, reads the key, and exports it to the environment: ```bash CONFIG_LOCATIONS=( "./x402-config.json" "$HOME/.x402-config.json" "$PWD/x402-config.json" ) # Check each location for config file for CONFIG_FILE in "${CONFIG_LOCATIONS[@]}"; do if [ -f "$CONFIG_FILE" ]; then PRIVATE_KEY=$(jq -r '.private_key' "$CONFIG_FILE" 2>/dev/null || echo "") if [ -n "$PRIVATE_KEY" ]; then export X402_PRIVATE_KEY="$PRIVATE_KEY" break fi fi done ``` The exported key is subsequently inherited by the npm package: ```bash npx -y @itzannetos/x402-tools-claude find-people "$QUERY" ``` ### Technical Analysis The recommended `echo ... > ~/.x402-config.json` command does not enforce a restrictive `umask` or file mode. Under common default configurations, the file may be created with permissions that allow other local users to read it. The script does not inspect ownership, reject symbolic links, or verify that the selected file has mode `0600`. The current-directory configuration file takes precedence over the home-directory file. A file supplied through an untrusted working directory could therefore control which wallet key is used. Although this does not expose the user's existing key by itself, it weakens configuration trust and may cause transactions to be performed using unintended credentials. After reading the key, the script exports it globally to the child-process environment. Every process launched through the `npx` command—including package lifecycle scripts ...[truncated 1760 chars]

Remediation

View remediation

"$HOME/.x402-config.json" chmod 600 "$HOME/.x402-config.json" ``` 4. Before reading the file, verify that it: - Is owned by the current user. - Is a regular file and not a symbolic link. - Is not group- or world-readable or writable. 5. Remove duplicate and current-directory configuration lookup paths unless explicitly required. Prefer one trusted, absolute configuration location. 6. Do not export the raw key into a broad process environment. Pass signing requests through a narrowly scoped interface that enforces transaction amount, destination, chain ID, and method restrictions. 7. Execute payment code in an isolated process with a minimal environment and restricted filesystem/network access. 8. Clear shell variables containing the key after use where practical, and rotate any key that may already have been stored with unsafe permissions or exposed to untrusted package code. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs users to store a blockchain payment private key in an environment variable or plaintext local JSON file, including a recommended home-directory path, without any security guidance about file permissions, secret managers, or the risk of key theft. Because this key authorizes spending via x402/Base, compromise of the host, shell history, backups, or readable dotfiles could expose the credential and enable unauthorized payments or wallet misuse.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The example persists the private key to ~/.x402-config.json, creating long-lived credential storage on disk and normalizing secret retention across sessions. In an agent/tooling environment, persistent home-directory secrets are especially risky because other tools, logs, backups, or compromised processes may read them later, turning a one-time payment credential into durable compromise.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

2. Home directory: ~/.x402-config.json ← Recommended
3. Working directory: $PWD/x402-config.json

Create the config file:

json

{
  "private_key": "0x1234567890abcdef..."

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/research.sh (reported line 40)May include surrounding context.

sh

echo ""
    echo "Please configure your private key using one of these methods:"
    echo "1. Set environment variable: export X402_PRIVATE_KEY=\"0x...\""
    echo "2. Create x402-config.json in current directory with:"
    echo '   {"private_key": "0x..."}'
    echo "3. Create ~/.x402-config.json in your home directory"
    exit 1

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The script executes an npm package via npx -y without pinning a specific version, so each run may fetch and execute whatever code is currently published under that package name. This creates a supply-chain execution risk: a compromised publisher account, malicious update, or dependency hijack could immediately lead to arbitrary code execution in the user's environment, with access to the loaded X402_PRIVATE_KEY and other local data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.