Configure X402

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:47 PM UTC
• Version: 0.1.0

Overview

This is a disclosed x402 payment-configuration skill with no bundled executable code, but users should review payment limits and avoid mutable install commands.

Install from a pinned, reviewed ClawHub version when possible. Before using the skill, confirm the wallet address, mode, gated tools, public manifest behavior, and maxSpendPerHour limit, because the resulting configuration can cause future agent requests to send or request USDC payments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:9

Finding

Unpinned npm Tool and Mutable Git Branch Create Supply-Chain Execution Risk

Content

View full analysis

Vulnerability Details

File Location: README.md, line 9
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/configure-x402

Technical Analysis

The installation command invokes the third-party skills npm package through npx without specifying an exact audited version. It also installs Skill content from the mutable main branch rather than a reviewed commit SHA.

Consequently, the components executed or installed when a user runs this command may differ from those examined during this audit. Compromise of the npm package, its publisher account, the GitHub repository, or a repository maintainer could replace either the installation logic or downloaded Skill content with a malicious payload.

This audit found no malicious payload in the current project snapshot. The vulnerability is the absence of immutable dependency and source pinning in the documented installation process.

Attack Path

1. An attacker compromises the npm publisher, the skills package, the GitHub repository, or a maintainer account.
2. The attacker publishes a malicious package version or modifies content on the repository's main branch.
3. A user runs the documented installation command.
4. npx resolves and invokes the current unpinned package, while the installer retrieves current content from the mutable branch.
5. Malicious installation behavior or Skill instructions execute under the invoking user's privileges.

Impact Assessment

A successful supply-chain compromise could execute commands or install malicious Skill content with the permissions of the user running npx. Depending on those permissions and the upstream installer behavior, this could expose accessible files and credentials, modify the user's development environment, or establish further compromise.

The project itself does not request elevated privileges, and no ...[truncated 129 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the skills npm package to a reviewed exact version rather than relying on implicit package resolution.
• Replace the mutable main branch URL with an immutable, reviewed Git commit SHA.
• Verify downloaded artifacts using a published cryptographic digest or signature.
• Review the resolved npm package and repository commit before recommending them to users.
• Disable or avoid npm lifecycle scripts where supported and unnecessary.
• Document the expected package version, repository commit, and integrity value so installations are reproducible.

T08 · Insecure Dependencies

Warning

• Location: README.md:15

Finding

Use of Mutable npm Latest Tag Exposes Installation to Upstream Package Changes

Content

View full analysis

Vulnerability Details

File Location: README.md, line 15
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

npx clawhub@latest install configure-x402

Technical Analysis

The installation command explicitly uses the mutable npm latest distribution tag. That tag can be reassigned to any future package release, so users may execute code that was not part of the audited project snapshot.

If the package publisher account or registry publishing pipeline is compromised—or if a future release is malicious—the command can retrieve and invoke the altered package through npx. The current project contains no evidence that clawhub is malicious; the issue is that the installation instructions do not identify or verify an immutable audited release.

Attack Path

1. An attacker compromises the clawhub publisher account, package publishing pipeline, or relevant registry infrastructure.
2. The attacker publishes a malicious release and assigns it the latest tag.
3. A user follows the README and runs the documented command.
4. npx downloads and invokes the attacker-controlled release.
5. The package executes within the invoking user's security context and may install additional malicious content.

Impact Assessment

Successful exploitation could permit arbitrary behavior allowed to an npm package under the invoking user's account. Potential scope includes reading or changing user-accessible files, accessing credentials exposed to the process, altering the development environment, and downloading additional payloads.

No elevated privilege request or malicious implementation was found in the audited files, so administrator-level compromise cannot be asserted from the available evidence.

Remediation

View remediation

Remediation Suggestions

• Replace clawhub@latest with a reviewed exact package version.
• Publish and verify the package's integrity hash or a cryptographic signature.
• Use a lockfile or another reproducible installation mechanism where applicable.
• Audit each version before updating the documented installation command.
• Minimize installer privileges and execute installation in a sandboxed environment where practical.
• Avoid unnecessary npm lifecycle scripts and document all expected installation-time behavior.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run an unpinned npx skills add command directly from a remote GitHub repository path, which can fetch changing code over time. That creates a supply-chain risk: if the package/tooling or referenced repository content is modified maliciously or compromised, users may execute unexpected code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README also recommends npx clawhub@latest install configure-x402, and @latest is a moving target that can resolve to different code at different times. If the upstream package is compromised or a malicious release is published, users could execute attacker-controlled installation logic.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: configure-x402
description: Configure x402 micropayments for agent-to-agent commerce via Uniswap. Set up your agent to pay per MCP request in USDC on Base (~200ms settlement) or accept x402 payments as a service provider. Use when the user wants to enable pay-per-use API access or monetize their agent's services.
model: sonnet
---

# Configure x402

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

## Parameters

| Parameter         | Required | Default     | Description                                                                                           |
|-------------------|----------|-------------|-------------------------------------------------------------------------------------------------------|
| `mode`            | No       | both        | Payment mode: "pay" (pay for services), "accept" (accept payments), or "both"                         |
| `walletAddress`   | Yes      | --          | USDC wallet address on Base for sending/receiving payments                                            |

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill claims it only generates local configuration files, but its workflow also directs wallet connectivity checks, balance verification, facilitator availability checks, and token approval verification, all of which imply external network or chain interactions. This mismatch can cause an agent or operator to authorize broader actions than expected, increasing the chance of unintended external calls, privacy leakage, or unsafe automation around payment infrastructure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.