T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:35- Finding
Automatic Payments Use Unbounded Payment Requirements and Unlimited Token Approval
- Content
View full analysis
- Remediation
View remediation
Security audit
tron-x402-payment
Security checks for vulnerabilities and agentic risk
Overview
This skill matches its TRON x402 payment purpose, but it can automatically approve and authorize wallet payments for arbitrary endpoints with weak spending and credential-scope controls.
Install only if you understand it can use a TRON private key to automatically pay x402 endpoints and grant broad token allowances. Use a dedicated low-balance wallet, prefer trusted HTTPS endpoints, avoid relying on unrelated mcporter credentials, and revoke token allowances after use.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
src/x402_tron_invoke.ts:160- Finding
Caller-Controlled URLs Enable SSRF and Unsafe Payment Delegation
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
src/x402_tron_invoke.ts:35- Finding
Credential Discovery Searches Unrelated MCP Server Configurations
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
package.json:6- Finding
Unpinned Security-Critical Dependencies Make Builds Non-Reproducible
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (51)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description is very specific: paying x402-enabled agent endpoints with TRC20 tokens on TRON. The provided code chunk instead consists largely of general-purpose blockchain ABI tooling: coders for addresses, arrays, tuples, bytes, numbers, strings; fragment/interface parsing; function/event/error encoding and decoding; address checksum utilities; and BigNumber/base64 helpers. These are supporting primitives commonly used in EVM-like ecosystems, but by themselves they do not perform payments, invoke x402 endpoints, interact with TRON nodes, construct TRC20 transfers, manage USDT/USDD, or handle endpoint authorization/payment workflows. This is therefore a material description-behavior mismatch for the supplied chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose is very specific: paying x402-enabled agent endpoints with TRC20 tokens on TRON. However, the code shown is largely third-party or bundled infrastructure from ethers-style libraries, centered on numeric conversions, byte/hex manipulation, hashing, ENS processing, typed-data encoding, and serialization. These are blockchain-adjacent primitives, but they do not themselves implement the claimed payment behavior. There is no evidence in this chunk of TRON-specific token handling, USDT/USDD payment execution, x402 protocol negotiation, endpoint payment invocation, or any transaction submission. Because the actual visible behavior is materially different from the declared primary purpose, this should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose is a concrete application behavior: paying x402-enabled agent endpoints using TRC20 tokens on TRON. The actual code chunk contains only generic bundled library internals for encoding/decoding, string processing, and cryptographic math. There is no evidence here of TRON RPC interaction, wallet/account handling, TRC20 contract calls, token denomination logic, endpoint payment negotiation, x402 protocol handling, or any invocation/payment orchestration. Because the code’s observed primary behavior is generic crypto/utility support rather than the declared payment functionality, this is a material description/behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose is a very specific payment capability: paying x402-enabled agent endpoints with TRC20 tokens on TRON. The supplied code instead consists of low-level cryptographic primitives and serialization utilities. While such primitives could be supporting components of a blockchain payment system, this chunk does not itself implement payment logic, TRON RPC/API access, token contract calls, wallet transaction construction/broadcasting, x402 negotiation, or endpoint payment invocation. Therefore the actual behavior shown is materially different from the declared primary purpose, making this a description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description claims a payment skill for x402-enabled agent endpoints using TRC20 tokens on TRON. However, this code chunk appears to be infrastructure/dependency code only: generated google protobuf support, async control-flow helpers, and big-number arithmetic libraries. These are supporting utilities and do not themselves implement the declared payment behavior. Critically, there is no evidence in the provided snippet of blockchain/network interaction, token transfer construction, endpoint payment handling, TRON-specific APIs, contract calls, signing, or USDT/USDD logic. Therefore, the supplied code chunk does not accurately represent the declared purpose and is a material mismatch based on the observable behavior in this chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose is a specific blockchain payment capability: paying x402-enabled agent endpoints with TRC20 tokens on TRON. However, this code chunk is dominated by general-purpose support libraries (bn.js big integer operations, reduction contexts, Montgomery math, stream utilities, event emitter code, and follow-redirects HTTP request logic). None of the visible code demonstrates TRON network interaction, TRC20 contract calls, token selection for USDT/USDD, wallet signing, x402 protocol handling, or endpoint payment execution. While some of these libraries could be supporting dependencies for such a skill, the actual chunk itself does not materially implement the declared payment behavior, so the description is not accurately represented by this supplied code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description is narrowly about paying x402-enabled agent endpoints with TRC20 tokens on the TRON network. In contrast, this code chunk shows no TRON-specific logic, no wallet handling, no token transfer construction/signing, no USDT/USDD handling, no blockchain RPC interaction, and no x402 payment protocol behavior. Instead, it contains bundled generic HTTP client and form-data submission code plus unrelated utilities. These are materially different capabilities and indicate the code chunk does not match the declared payment-focused purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says the skill pays for x402-enabled agent endpoints using TRC20 tokens on TRON. However, the supplied code chunk is clearly from a semver/version-comparison implementation. It operates on version ranges and prerelease parsing, with functions like prerelease(), intersects(), and coerce(). There is no visible code for blockchain interaction, token transfers, endpoint payment, TRON APIs, or TRC20 asset handling. This is a material mismatch in primary purpose, not merely a supporting utility detail.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: tron-x402-payment description: "Pay for x402-enabled Agent endpoints using TRC20 tokens (USDT/USDD) on TRON" version: 1.1.0 author: open-aibank homepage: https://x402.org metadata: {"clawdbot":{"emoji":"💳","env":["TRON_PRIVATE_KEY"]}} tags: [crypto, payments, x402, agents, api, usdt, usdd, tron] requires_tools: [x402_tron_invoke] # Tool implementation mapping: x402_tron_invoke -> dist/x402_tron_invoke.js arguments: url: description: "Base URL of the agent (v2) or full URL (v1/Discovery)" required: true entrypoint: description: "Entrypoint name to invoke (e.g., 'chat', 'search')" required:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md # Tool implementation mapping: x402_tron_invoke -> dist/x402_tron_invoke.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md # Tool implementation mapping: x402_tron_invoke -> dist/x402_tron_invoke.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md # Tool implementation mapping: x402_tron_invoke -> dist/x402_tron_invoke.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md # Tool implementation mapping: x402_tron_invoke -> dist/x402_tron_invoke.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md # Tool implementation mapping: x402_tron_invoke -> dist/x402_tron_invoke.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md # Tool implementation mapping: x402_tron_invoke -> dist/x402_tron_invoke.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md # Tool implementation mapping: x402_tron_invoke -> dist/x402_tron_invoke.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md # Tool implementation mapping: x402_tron_invoke -> dist/x402_tron_invoke.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md # Tool implementation mapping: x402_tron_invoke -> dist/x402_tron_invoke.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md # Tool implementation mapping: x402_tron_invoke -> dist/x402_tron_invoke.js
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
js er.throwArgumentError("unbalanced parenthesis", "value", value); } } } } if (accum) { result.push(accum); } return result; } //# sourceMappingURL=fragments.js.map /***/ }), /***/ 219: /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => { Object.defineProperty(exports, "__esModule", ({ value: true })); exports.TransactionDescription = exports.LogDescription = exports.checkResultErrors = exports.Indexed = exports.Interface = exports.defaultAbiCoder = exports.AbiCoder = exports.FormatTypes = exports.ParamType = exports.FunctionFragment = exports.Fragment = exports.EventFragment = exports.ErrorFragment = exports.ConstructorFragment = void 0; var fragments_1 = __nccwpck_require__(5186); Object.defineProperty(exports, "ConstructorFragment", ({ enumerable: true, get: function () { return fragments_1.ConstructorFragment; } })); Object.defineProperty(exports, "ErrorFragment", ({ enumerable: true, get: function () { re
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code tells the agent not to search for or read private keys manually, while the program itself already performs silent file and config scanning for private keys. This contradiction is dangerous because it disguises credential discovery behavior and may mislead reviewers or users about the actual trust boundary and data access performed by the skill.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts console.error('Error: Payment credentials not found. Missing environment variable: TRON_PRIVATE_KEY.'); console.error('Please set TRON_PRIVATE_KEY before running this tool.'); console.error('Alternatively, configure ~/.mcporter/mcporter.json or x402-config.json.'); console.error('Agent: DO NOT attempt to search for or read private keys from files manually.'); process.exit(1); }
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill declares a network-capable compiled tool and explicitly references environment-based secret access, but it does not define any explicit tool scope or allowed-tool restrictions. In a payment skill that can read wallet credentials and contact arbitrary URLs, missing scope boundaries increases the chance of unintended shell/network behavior or abuse by downstream agents.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
node dist/x402_tron_invoke.js --url https://api.example.com --entrypoint chat --input '{"prompt": "hi"}'
Direct/Discovery
node dist/x402_tron_invoke.js --url https://api.example.com/.well-known/agent.json
text ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
node dist/x402_tron_invoke.js --url https://api.example.com --entrypoint chat --input '{"prompt": "hi"}'
Direct/Discovery
node dist/x402_tron_invoke.js --url https://api.example.com/.well-known/agent.json
text ---
Static analysis
Detected: suspicious.dynamic_code_execution, suspicious.env_credential_access, suspicious.exposed_secret_literal (+1 more)
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- dist/x402_tron_invoke.js:30830
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/x402_tron_invoke.js:21722
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- dist/x402_tron_invoke.js:23459
Potential obfuscated payload detected.
Warn
- Code
- suspicious.obfuscated_code
- Location
- dist/x402_tron_invoke.js:2813