x402 Creative Resources

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:32 PM UTC
• Version: 1.0.0

Overview

The skill’s paid Xona API purpose is disclosed, but its wallet-enabled fetch script can be directed to arbitrary URLs and lacks spending controls.

Install only if you are comfortable giving this skill a dedicated low-balance Solana wallet for automatic paid API calls. Review or restrict the script so it can call only approved api.xona-agent.com paths, enforce per-call and session spending limits, validate payment recipients and amounts, and pin the wallet dependency before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/x402-fetch.js:43

Finding

Wallet-Enabled Requests Permit Arbitrary Network Destinations

Content

View full analysis

0; ``` ### Technical Analysis The script passes the wallet private key to `wrapFetch`, creating a client capable of handling x402 payment challenges. It then accepts any endpoint beginning with `http` as a complete destination. There is no validation of the URL protocol, hostname, port, path, or payment recipient. Although the Skill documentation states that requests are intended for `https://api.xona-agent.com`, the implementation does not enforce this boundary. In addition, `XONA_API_BASE` may redirect relative endpoints to another destination. An attacker who can influence command arguments or environment variables could direct the wallet-enabled client to an attacker-controlled x402 server. Depending on the behavior of `@dexterai/x402`, the malicious server could induce signatures or payments. Arbitrary URLs may also expose internal HTTP services, creating an SSRF-like network access capability. The reviewed source does not show the raw private key being serialized or directly transmitted. The principal risk is unauthorized use of the key by the payment wrapper against untrusted destinations. ### Attack Path 1. An attacker influences the endpoint argument supplied to `x402-fetch.js`, for example through a malicious prompt or unsafe automation. 2. The attacker supplies an absolute URL such as `https://attacker.example/payment`. 3. Because the value starts with `http`, the script accepts it without applying the documented API base. 4. The script creates `x402Fetch` using `XONA_WALLET_SECRET`. 5. The attacker-controlled server ...[truncated 939 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/x402-fetch.js:43

Finding

Automatic Wallet Payments Lack Spending and Consent Controls

Content

View full analysis

0; const method = hasPayload ? 'POST' : 'GET'; const fetchOptions = { method, headers: { 'Content-Type': 'application/json' } }; if (hasPayload) { fetchOptions.body = payloadArg; } try { const response = await x402Fetch(url, fetchOptions); ``` The corresponding Skill instructions explicitly describe automatic spending: ```md All endpoints live on `https://api.xona-agent.com` and are paid via x402 (Solana USDC micropayments). The agent wallet pays automatically. ## How to Call x402 Endpoints Use the `x402-fetch.js` script in the workspace scripts folder. It handles the 402 payment flow automatically using the agent's Solana wallet. ``` ### Technical Analysis The wallet-enabled fetch wrapper automatically handles x402 payment negotiation. The calling code does not enforce: - A maximum amount per request. - A cumulative session or daily spending limit. - An expected price for each endpoint. - An approved payment recipient. - An approved blockchain network or token. - Explicit user confirmation for expensive or repeated calls. - Replay, duplication, or workflow-loop protections. The documentation advertises prices, but these values are not represented or enforced by the client. Consequently, the client may rely entirely on payment terms returned by a remote service. This exceeds least-privilege requirements. The declared functionality requires bounded payments to known services, not unrestricted authority to accept arbitrary payment requirements using an Agent wallet. ### Attack Path 1. An attacker manipul ...[truncated 1153 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/package.json:6

Finding

Security-Critical Wallet Dependency Is Not Reproducibly Pinned

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill exposes networked, payment-capable behavior but does not declare any explicit tool scope or permission boundary. That makes it easier for an agent runtime or reviewer to miss that the skill can initiate external requests and indirectly spend wallet funds, increasing the chance of unintended execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill states that 'the agent wallet pays automatically' but does not surface a clear user-facing warning in the skill description or usage guardrails. This can cause silent financial spend on behalf of the agent/operator, especially if the skill is invoked for exploratory or repeated generation workflows.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

Resource Discovery

bash

curl -s https://api.xona-agent.com/x402-resources

---

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The combination of user-controlled endpoint selection and wallet-backed wrapFetch creates a general-purpose outbound HTTP capability rather than a narrowly scoped creative/news/token tool. In skill context, this is more dangerous because the embedded Solana private key authorizes paid x402 requests, so an attacker who can influence inputs may repurpose the skill for unrelated billable or sensitive network interactions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script allows any endpoint beginning with 'http' to be fetched directly, bypassing the intended XONA_API_BASE restriction. Because requests are made through a wallet-backed x402 client, this turns the skill into a generic authenticated outbound fetch primitive that could be abused to spend funds, reach unintended paid services, or interact with attacker-controlled infrastructure outside the skill's declared scope.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The dependency uses a caret range (^1.4.0), which permits automatic installation of newer minor and patch releases. This creates supply-chain risk because builds are not fully reproducible and a compromised or breaking upstream release of @dexterai/x402 could be pulled in without explicit review, which is relevant here because the package is used for x402 payment scripts.

Content

Scanner excerpt · scripts/package.json (reported line 7)May include surrounding context.

json

"private": true,
  "description": "x402 payment scripts",
  "dependencies": {
    "@dexterai/x402": "^1.4.0"
  }
}

Static analysis

No suspicious patterns detected.