ClawHub
Back to skill

Security audit

X402 Cfo

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for paid x402 API use, but it delegates wallet-based payment authority with broad defaults and an unpinned dependency, so it should be reviewed carefully before installation.

Review this before installing. Use only a pinned and audited x402-cfo version, prefer npm ci with a committed lockfile, restrict the wallet or session key to small limits and approved recipients, add an explicit destination allowlist, and require confirmation before first payment to any new endpoint. Also decide whether ./x402-cfo-ledger.json is acceptable in the project because it records payment audit details.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
skill.md:16
Finding
Unpinned Third-Party Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `skill.md`, lines 16-20 **Vulnerability Type**: Supply-chain exposure through an unpinned npm dependency **Risk Level**: High ### Vulnerable Code ```markdown ## Setup Before using this skill, ensure x402-cfo is installed in the current project: ```bash npm list x402-cfo 2>/dev/null || npm install x402-cfo ``` ``` ### Technical Analysis The setup instruction installs `x402-cfo` without specifying an exact version or verifying package integrity. Consequently, installation resolves to whatever version the configured npm registry currently serves. The package's source code, lifecycle scripts, and runtime behavior are not included in the audited project. This dependency is especially sensitive because it receives a payment-capable wallet and mediates paid network requests. A compromised package release, registry account, registry configuration, or dependency chain could execute arbitrary JavaScript during installation or runtime. Redirecting `npm list` diagnostics to `/dev/null` also reduces visibility into errors that could indicate an unexpected local dependency state. The documented payment functionality legitimately requires an implementation dependency, but installing an unpinned and unaudited version is not necessary to provide that functionality. ### Attack Path 1. An attacker compromises the `x402-cfo` package, one of its transitive dependencies, its publisher account, or the configured npm registry. 2. The attacker publishes or serves a modified version containing a malicious lifecycle script or runtime payload. 3. The Agent follows the Skill setup instructions and runs `npm install x402-cfo`. 4. npm resolves and installs the attacker-controlled release because no exact version or integrity value is specified. 5. The malicious code executes with the permissions of the Agent process. 6. During initialization, the package may also gain access to the supplied wallet object and use or disclose its p ...[truncated 470 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin `x402-cfo` to a specific, reviewed version rather than installing the latest available release: ```bash npm install --save-exact x402-cfo@<audited-version> ``` 2. Commit and enforce a lockfile with verified registry integrity hashes. Use `npm ci` in controlled environments instead of dynamically resolving dependencies. 3. Audit the selected package version, its transitive dependencies, and all npm lifecycle scripts before deployment. 4. Use a trusted, explicitly configured package registry and enable package provenance verification where supported. 5. Disable lifecycle scripts during installation when they are unnecessary: ```bash npm ci --ignore-scripts ``` 6. Run the dependency in a sandbox with minimal filesystem, environment-variable, wallet, and network permissions. 7. Do not suppress dependency-check errors. Surface and handle installation failures explicitly. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error
Location
skill.md:29
Finding
Broad Wallet Delegation Without a Default Destination Allowlist<![CDATA[ ## Vulnerability Details **File Location**: `skill.md`, lines 29-50 **Vulnerability Type**: Excessive payment authority and insufficient destination restrictions **Risk Level**: High ### Vulnerable Code ```typescript import { AgentCFO, JsonFileStorage } from 'x402-cfo'; const cfo = new AgentCFO({ wallet: walletInstance, // Your x402-compatible wallet budget: { hourly: parseFloat(process.env.X402_BUDGET_HOURLY || '5'), daily: parseFloat(process.env.X402_BUDGET_DAILY || '50'), session: parseFloat(process.env.X402_BUDGET_SESSION || '200'), }, policy: { maxPerRequest: parseFloat(process.env.X402_MAX_PER_REQUEST || '2.00'), allowedCurrencies: ['USDC'], allowedNetworks: (process.env.X402_NETWORKS || 'base').split(','), blocklist: (process.env.X402_BLOCKLIST || '').split(',').filter(Boolean), }, storage: new JsonFileStorage('./x402-cfo-ledger.json'), }); ``` ```typescript const response = await cfo.fetch('https://api.paid-service.com/v1/data'); ``` ### Technical Analysis The Skill delegates a payment-capable `walletInstance` to a third-party package and permits paid requests to caller-selected URLs. Destination control relies on `X402_BLOCKLIST`, which is empty by default. A denylist cannot reliably constrain arbitrary or newly created attacker-controlled domains, alternate hostnames, IP addresses, redirects, or endpoints not previously identified as malicious. Although hourly, daily, session, and per-request budgets limit financial loss, they do not establish whether a recipient is authorized. The default session budget is `200` USDC, while the default per-request limit is `2.00` USDC, allowing repeated payments to consume the session budget. Moreover, the environment variables can raise those limits if the surrounding environment is misconfigured or compromised. Sending payment authorization over the network is inherent to the declared x402 payment functionality. However, giving a package broad wallet access a ...[truncated 1555 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Replace the default-open blocklist policy with a mandatory destination allowlist containing approved HTTPS origins, ports, paths, payment recipients, currencies, and networks. 2. Reject direct IP addresses, ambiguous hostnames, embedded credentials, non-HTTPS URLs, and destinations outside the explicit allowlist. 3. Resolve and validate destinations securely, including DNS results and every redirect target, to prevent allowlist bypass and server-side request forgery. 4. Require explicit user confirmation before paying a new recipient or exceeding a conservative transaction threshold. 5. Use a restricted wallet or delegated session key that enforces recipient, currency, network, per-transaction, cumulative-value, and expiration constraints at the wallet or smart-contract level. 6. Reduce default budgets and require explicit opt-in before enabling payment capability. Do not rely on application-level budgets as the sole authorization boundary. 7. Validate all budget environment variables with finite-number checks, nonnegative bounds, and hard maximums. 8. Separate URL retrieval from payment authorization and verify the complete x402 challenge, recipient, amount, network, and currency before signing. 9. Run the payment mediator in an isolated process with no access to unrelated secrets or files, and maintain tamper-resistant payment audit logs. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs agents to use `cfo.fetch()` for paid endpoints and configures persistent ledger storage, but it does not clearly warn that this can trigger real monetary transactions and write an audit file to disk. In an autonomous-agent context, missing consent and side-effect disclosure is dangerous because users may unknowingly authorize spending and persistent logging.

External Transmission

Medium
Category
Data Exfiltration
Content
ALWAYS use `cfo.fetch()` instead of raw `fetch()` for any x402 endpoint:

```typescript
const response = await cfo.fetch('https://api.paid-service.com/v1/data');
```

The CFO will automatically:
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
ALWAYS use `cfo.fetch()` instead of raw `fetch()` for any x402 endpoint:

```typescript
const response = await cfo.fetch('https://api.paid-service.com/v1/data');
```

The CFO will automatically:
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.