Find People (x402)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:58 AM UTC
• Version: 1.0.0

Overview

This skill has a coherent paid OSINT purpose, but it asks users to expose a wallet private key to long-lived plaintext storage and dynamically downloaded code.

Install only if you are comfortable using a dedicated low-balance wallet and running an unpinned third-party npm package with access to that wallet key. Prefer not to store the key in plaintext; if you do, restrict permissions and rotate or move funds if the key may already have been exposed.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/research.sh:47
• Finding: Unpinned npm Package Is Remotely Retrieved and Executed<![CDATA[ ## Vulnerability Details **File Location**: `scripts/research.sh:47` **Vulnerability Type**: Remote execution of an unpinned third-party dependency **Risk Level**: High ### Vulnerable Code ```bash npx -y @itzannetos/x402-tools-claude find-people "$QUERY" ``` ### Technical Analysis The script uses `npx -y` to retrieve and execute `@itzannetos/x402-tools-claude` at runtime. No exact package version, lockfile, or integrity hash is specified. The `-y` option automatically accepts package installation without interactive confirmation. Consequently, the effective executable payload is not contained in the audited project and can change after review. A compromised npm publisher account, malicious future package release, registry compromise, or dependency-chain compromise could cause arbitrary JavaScript to execute under the invoking user's account. This is especially sensitive because the script exports `X402_PRIVATE_KEY` before invoking the package. The downloaded package therefore inherits the wallet private key and other environment variables available to the process. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or one of its transitive dependencies. 2. The attacker publishes a malicious release under the existing package name. 3. A user runs `scripts/research.sh`. 4. `npx -y` resolves and downloads the current package release without confirmation or integrity validation. 5. The package executes locally with the privileges of the invoking user. 6. The malicious code reads `X402_PRIVATE_KEY` from its environment and may transmit it externally, authorize wallet transactions, access user-readable files, or execute additional commands. ### Impact Assessment Successful exploitation provides arbitrary code execution with the invoking user's operating-system privileges. The accessible scope includes: - The exported cryptocurrency wallet private key. - Wallet funds and signing authority associated with that key. - ...[truncated 380 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not retrieve executable packages dynamically during normal Skill execution. 2. Pin the package to a reviewed, exact version rather than a tag or version range. 3. Install dependencies during a controlled build or setup phase and commit an npm lockfile with integrity hashes. 4. Use `npm ci --ignore-scripts` where lifecycle scripts are unnecessary, and separately review any scripts that must run. 5. Vendor the required implementation into the project when feasible so its effective behavior is included in security review. 6. Verify package provenance and signatures, monitor publisher ownership changes, and routinely audit transitive dependencies. 7. Run the external client in a sandbox with restricted filesystem and network access. 8. Avoid exposing a raw private key to third-party package code. Prefer a constrained signing service or isolated signer that validates the network, destination, amount, and method before approving a transaction. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/research.sh:15
• Finding: Wallet Private Key Is Stored in Plaintext and Exported to Third-Party Code<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:19-36`; `scripts/research.sh:15-29` **Vulnerability Type**: Insecure sensitive credential storage and propagation **Risk Level**: High ### Vulnerable Code The documentation recommends creating a plaintext private-key file without setting restrictive permissions: ```bash echo '{"private_key": "0x..."}' > ~/.x402-config.json ``` The script searches user-controlled filesystem locations, reads the key, and exports it to the environment: ```bash CONFIG_LOCATIONS=( "./x402-config.json" "$HOME/.x402-config.json" "$PWD/x402-config.json" ) # Check each location for config file for CONFIG_FILE in "${CONFIG_LOCATIONS[@]}"; do if [ -f "$CONFIG_FILE" ]; then PRIVATE_KEY=$(jq -r '.private_key' "$CONFIG_FILE" 2>/dev/null || echo "") if [ -n "$PRIVATE_KEY" ]; then export X402_PRIVATE_KEY="$PRIVATE_KEY" break fi fi done ``` The exported key is subsequently inherited by the npm package: ```bash npx -y @itzannetos/x402-tools-claude find-people "$QUERY" ``` ### Technical Analysis The recommended `echo ... > ~/.x402-config.json` command does not enforce a restrictive `umask` or file mode. Under common default configurations, the file may be created with permissions that allow other local users to read it. The script does not inspect ownership, reject symbolic links, or verify that the selected file has mode `0600`. The current-directory configuration file takes precedence over the home-directory file. A file supplied through an untrusted working directory could therefore control which wallet key is used. Although this does not expose the user's existing key by itself, it weakens configuration trust and may cause transactions to be performed using unintended credentials. After reading the key, the script exports it globally to the child-process environment. Every process launched through the `npx` command—including package lifecycle scripts ...[truncated 1760 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace raw private-key handling with a dedicated signer, hardware wallet, operating-system keychain, or constrained signing service. 2. Use a dedicated low-balance wallet with no unrelated assets or unlimited token approvals. 3. If a configuration file remains necessary, create it securely: ```bash umask 077 printf '%s\n' '{"private_key":"0x..."}' > "$HOME/.x402-config.json" chmod 600 "$HOME/.x402-config.json" ``` 4. Before reading the file, verify that it: - Is owned by the current user. - Is a regular file and not a symbolic link. - Is not group- or world-readable or writable. 5. Remove duplicate and current-directory configuration lookup paths unless explicitly required. Prefer one trusted, absolute configuration location. 6. Do not export the raw key into a broad process environment. Pass signing requests through a narrowly scoped interface that enforces transaction amount, destination, chain ID, and method restrictions. 7. Execute payment code in an isolated process with a minimal environment and restricted filesystem/network access. 8. Clear shell variables containing the key after use where practical, and rotate any key that may already have been stored with unsafe permissions or exposed to untrusted package code. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs users to store a blockchain payment private key in an environment variable or plaintext local JSON file, including a recommended home-directory path, without any security guidance about file permissions, secret managers, or the risk of key theft. Because this key authorizes spending via x402/Base, compromise of the host, shell history, backups, or readable dotfiles could expose the credential and enable unauthorized payments or wallet misuse.

Session Persistence

Medium

• Category: Rogue Agent

Content

2. Home directory: `~/.x402-config.json` ← **Recommended**
3. Working directory: `$PWD/x402-config.json`

Create the config file:
```json
{
  "private_key": "0x1234567890abcdef..."

• Confidence: 95% confidence
• Finding: The example persists the private key to ~/.x402-config.json, creating long-lived credential storage on disk and normalizing secret retention across sessions. In an agent/tooling environment, persistent home-directory secrets are especially risky because other tools, logs, backups, or compromised processes may read them later, turning a one-time payment credential into durable compromise.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo ""
    echo "Please configure your private key using one of these methods:"
    echo "1. Set environment variable: export X402_PRIVATE_KEY=\"0x...\""
    echo "2. Create x402-config.json in current directory with:"
    echo '   {"private_key": "0x..."}'
    echo "3. Create ~/.x402-config.json in your home directory"
    exit 1

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The script executes an npm package via `npx -y` without pinning a specific version, so each run may fetch and execute whatever code is currently published under that package name. This creates a supply-chain execution risk: a compromised publisher account, malicious update, or dependency hijack could immediately lead to arbitrary code execution in the user's environment, with access to the loaded `X402_PRIVATE_KEY` and other local data.

Static analysis

No suspicious patterns detected.