T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:90
- Finding
- Untrusted XMR402 challenges can initiate wallet payments without explicit user approval<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:90-111`; `scripts/monero_wallet_rpc.py:72-80` **Vulnerability Type**: Missing authorization controls for financial transactions **Risk Level**: High ### Vulnerable Code ```markdown If your HTTP request to an external URL returns **HTTP 402 Payment Required**, you MUST follow this exact procedure: ### Step 1: Parse the Challenge Read the `WWW-Authenticate` response header. It will contain: ```http WWW-Authenticate: XMR402 address="<subaddress>", amount="<piconero>", message="<nonce>", timestamp="<unix_ms>" ``` - **address**: Monero subaddress to pay. - **amount**: Amount in atomic units (Piconero). Divide by `1e12` for XMR. - **message**: Anti-replay nonce. Pass this EXACTLY to the `pay-402` command. ### Step 2: Pay the Invoice ```bash python3 scripts/monero_wallet_rpc.py pay-402 "<address>" <amount_in_xmr> "<message>" ``` ``` ```python def pay_402(address, amount_xmr, message, api_key=None): """XMR402 Protocol: Pay a 402 challenge and get back an Authorization header.""" res = api_call("pay_402", method="POST", data={ "address": address, "amount_xmr": float(amount_xmr), "message": message }, api_key=api_key) print(json.dumps(res)) ``` ### Technical Analysis The Skill directs the agent to pay an XMR402 challenge whenever an external HTTP service returns status 402. The destination address, amount, and nonce are controlled by that external service. Neither the instructions nor the helper require explicit user approval, validate that the payment matches an expected price, restrict eligible origins, or enforce a caller-defined transaction budget. The documented gateway spending limits reduce the maximum potential loss but do not establish that an individual payment is authorized. Duplicate-nonce checks also prevent only repeated payment of the same challenge; they do not establish the legitimacy of the initial payment. ### Attack Path 1. An agent accesse ...[truncated 892 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Require explicit, informed user approval before every XMR402 payment. - Display the origin, destination address, amount in both atomic units and XMR, and nonce before requesting approval. - Require the caller to supply a maximum expected price and reject challenges exceeding it. - Restrict automatic payment, if supported at all, to an explicit allowlist of trusted HTTPS origins. - Bind authorization to the requesting origin and exact resource so one site's challenge cannot be reused in another context. - Validate Monero address syntax, amount positivity and range, nonce format, and timestamp freshness. - Preserve gateway-side per-payment and daily limits as defense in depth rather than treating them as user authorization. - Default to refusing payment when trust, pricing, or approval information is unavailable. ]]>