T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:90- Finding
Untrusted XMR402 challenges can initiate wallet payments without explicit user approval
- Content
View full analysis
", amount="", message="", timestamp="" ``` - **address**: Monero subaddress to pay. - **amount**: Amount in atomic units (Piconero). Divide by `1e12` for XMR. - **message**: Anti-replay nonce. Pass this EXACTLY to the `pay-402` command. ### Step 2: Pay the Invoice ```bash python3 scripts/monero_wallet_rpc.py pay-402 "" "" ``` ``` ```python def pay_402(address, amount_xmr, message, api_key=None): """XMR402 Protocol: Pay a 402 challenge and get back an Authorization header.""" res = api_call("pay_402", method="POST", data={ "address": address, "amount_xmr": float(amount_xmr), "message": message }, api_key=api_key) print(json.dumps(res)) ``` ### Technical Analysis The Skill directs the agent to pay an XMR402 challenge whenever an external HTTP service returns status 402. The destination address, amount, and nonce are controlled by that external service. Neither the instructions nor the helper require explicit user approval, validate that the payment matches an expected price, restrict eligible origins, or enforce a caller-defined transaction budget. The documented gateway spending limits reduce the maximum potential loss but do not establish that an individual payment is authorized. Duplicate-nonce checks also prevent only repeated payment of the same challenge; they do not establish the legitimacy of the initial payment. ### Attack Path 1. An agent accesse ...[truncated 892 chars]- Remediation
View remediation