Security audit

Use this skill when the user wants to purchase a virtual debit card using crypto, create a prepaid card via x402 protocol, check virtual card status, or set up an EVM wallet for card payments. Trigger on: "buy a card", "get a virtual card", "create card", "card status", "setup wallet for card", or any intent involving purchasing virtual Visa/Mastercard with cryptocurrency.

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated crypto-card purpose, but it handles raw wallet private keys in risky ways and runs mutable npm code for financial operations.

Review carefully before installing. Use only a dedicated low-balance wallet, assume any private key entered may be exposed through agent context, command history, process listings, local files, or package behavior, and avoid running unpinned npx commands for funds unless you have independently verified the package and version.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:28
Finding: Unpinned Third-Party Package Execution and Automatic Upgrades
Content: View full analysis
--poll ``` `references/check-status.md:6-9`: ```bash # Single query npx @aeon-ai-pay/x402-card status --order-no # Poll until terminal status (SUCCESS or FAIL) npx @aeon-ai-pay/x402-card status --order-no --poll ``` `references/wallet-setup.md:10`: ```bash npx @aeon-ai-pay/x402-card setup --private-key 0x... ``` ### Technical Analysis Every sensitive operation executes `@aeon-ai-pay/x402-card` through `npx` without specifying an exact version. Consequently, the code executed during a future invocation may differ from the version that was reviewed. The mandatory background update check and subsequent `upgrade` instruction add another mutable code-delivery path. This dependency has access to an EVM private key and participates in financial transactions. A compromised npm publisher account, malicious release, dependency compromise, or compromised update channel could therefore execute arbitrary code under the account running the Agent. The audited project contains no package lockfile, integrity hash, vendored implementation, or signature-verification mechanism that would constrain the resolved payload. The package itself was not included ...[truncated 1546 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/wallet-setup.md:18
Finding: EVM Private Key Exposed Through Command-Line Arguments
Content: View full analysis
``` `references/wallet-setup.md:8-10`: ```bash npx @aeon-ai-pay/x402-card setup --private-key 0x... ``` `references/wallet-setup.md:18-21`: ```bash # Or pass via CLI flags per command: npx @aeon-ai-pay/x402-card wallet --private-key 0x... npx @aeon-ai-pay/x402-card create --amount 0.6 --private-key 0x... ``` ### Technical Analysis The documented workflow places the full EVM private key directly into a command-line argument. Command-line secrets can be exposed through shell history, process listings, command auditing, terminal capture, Agent transcripts, debugging output, monitoring telemetry, or error-reporting systems. The instruction not to display the full key does not protect these channels because the key has already been interpolated into the command before the CLI can mask its output. An EVM private key is a bearer credential: anyone who retrieves it can independently sign transactions without further authentication. ### Attack Path 1. The user supplies an EVM private key to the Agent. 2. The Agent inserts the full key into the `--private-key` command-line argument. 3. The command is recorded in shell history, execution telemetry, an Agent transcript, or a process inspection interface. 4. A same-user process, monitoring operator, malicious plugin, local attacker, or later log reader retrieves the argument. 5. The attacker imports the private key into another wallet. 6. The attacker signs and submits unauthorized transac ...[truncated 702 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:42
Finding: Wallet Private Key Persisted in a Plaintext Configuration File
Content: View full analysis
"Please provide your EVM wallet private key (BSC network). It will be stored locally at ~/.x402-card/config.json with restricted file permissions and never transmitted elsewhere." - Then run: ```bash npx @aeon-ai-pay/x402-card setup --private-key ``` ``` ### Technical Analysis The workflow persists the EVM private key in `~/.x402-card/config.json`. File mode `600` restricts access to the owning account but does not encrypt the credential. Any malicious or compromised process running as that user can read the file. This is particularly relevant because the same Skill executes a mutable third-party npm package under that account. The documentation states that the key is “never transmitted elsewhere,” but the executable package implementation is absent from the audited project. That assertion therefore cannot be verified from the supplied files. Persisting the key also extends the exposure period beyond the current Skill invocation. Later malware, compromised dependencies, backup systems, account compromise, or unintended file copies may obtain the credential. ### Attack Path 1. The Agent runs the setup command with the user's private key. 2. The CLI stores the key in `~/.x402-card/co ...[truncated 1061 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (28)

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to request the user's EVM private key in plain language and then persist it to local configuration. Requesting raw private keys is extremely dangerous because possession of the key grants full control over wallet funds, and the surrounding workflow already relies on dynamically executed npm code, magnifying the chance of exfiltration or misuse.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.
md
name: x402-card description: > Use this skill when the user wants to purchase a virtual debit card using crypto, create a prepaid card via x402 protocol, check virtual card status, or set up an EVM wallet for card payments. Trigger on: "buy a card", "get a virtual card", "create card", "card status", "setup wallet for card", or any intent involving purchasing virtual Visa/Mastercard with cryptocurrency.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger condition includes a broad catch-all phrase ('any intent involving purchasing virtual Visa/Mastercard with cryptocurrency'), which can cause the skill to activate in loosely related conversations. In a skill that requests wallet secrets and initiates fund-related operations, overbroad activation increases the chance of unnecessary exposure to sensitive prompts or accidental execution paths.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill description explains card purchase functionality but does not prominently warn, up front, that setup involves storing a highly sensitive EVM private key locally. Users may enter a wallet secret without understanding the persistence and compromise implications, especially given the financial context.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs the agent to run npx @aeon-ai-pay/x402-card without pinning a version, which causes code to be fetched and executed from the registry at runtime. In a skill that handles wallet setup and card purchases, this materially increases supply-chain risk: a compromised or newly malicious package version could exfiltrate secrets such as the EVM private key or alter payment behavior.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This unpinned npx invocation dynamically executes whatever package version is current at execution time. Because the skill's workflow involves sensitive wallet configuration and payment operations, a supply-chain compromise could lead to theft of funds, key exfiltration, or fraudulent transaction handling.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The command references an unversioned npm package via npx, creating a time-of-use dependency on the current registry state. In this context, any malicious update could abuse the status-check path to collect identifiers, enumerate activity, or prepare users to trust later malicious commands.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This command executes a remote package without version pinning, exposing the workflow to dependency hijack or malicious updates. Since the broader skill can access wallet-related configuration and user funds, the blast radius of a compromised package is substantial.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx @aeon-ai-pay/x402-card without a fixed version allows arbitrary future package changes to be executed. In a cryptocurrency payment skill, that can directly affect balance handling, destination addresses, or sensitive wallet material, making the risk more severe than in a low-privilege utility.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The upgrade-check command is especially risky because it normalizes periodic execution of an unpinned remote package. That expands the attack surface by encouraging repeated contact with and execution from the package registry during normal operation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill directs the agent to run an unpinned background upgrade check once per session. Because it is non-blocking and easy to ignore, it may silently introduce or normalize execution of unreviewed package code in a sensitive wallet-management context.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The explicit upgrade command is also unpinned, meaning the act of updating can execute an attacker-controlled latest version if the package or account is compromised. In a skill that stores or uses a private key, this could immediately lead to credential theft or unauthorized spending.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The config check uses an unpinned runtime package invocation, so even the supposedly safe preflight path executes mutable remote code. That is dangerous because users may provide a private key immediately after this step, trusting the setup flow initiated by code whose integrity is not fixed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This setup command takes a raw private key as an argument while executing an unpinned package fetched via npx. That combination creates a severe supply-chain exposure: a compromised package could capture the key from process arguments or during handling and exfiltrate it, leading to full wallet compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The documented private-key update flow again uses an unpinned npx package, preserving the same supply-chain and secret-exposure risk in a high-value operation. Because the command handles replacement credentials, compromise here can give an attacker immediate control over the newly supplied wallet.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The service URL update command is unpinned, so it still carries supply-chain risk even though it does not directly pass a private key in the invocation. A malicious package could still rewrite configuration, redirect traffic, or prepare later compromise of payment requests.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The documentation instructs users to execute an unpinned package via npx, which fetches the latest published version at runtime. If the package is compromised, updated maliciously, or a dependency in its install chain is hijacked, users could execute attacker-controlled code on their system while checking card status.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This command also uses unversioned npx, so the executed code is not fixed and can change over time without review. In a payments/card workflow, that increases risk because users may run the tool repeatedly and may supply sensitive order identifiers or operate in environments holding wallet credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs the agent to verify the presence of EVM_PRIVATE_KEY but provides no warning or safeguards around handling a highly sensitive secret. In a wallet and payment workflow, this increases the chance that an agent may prompt for, expose, log, or otherwise mishandle the private key, which could lead to full compromise of the user's funds.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill executes a package via npx without pinning an exact version, which allows the fetched code to change over time and introduces supply-chain risk. In this context the command is especially sensitive because it performs payment operations and interacts with an EVM wallet, so a compromised or malicious package version could trigger unauthorized transactions or exfiltrate wallet-related data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation repeatedly instructs users to place a private key directly on the command line, which can expose the secret through shell history, terminal logging, process listings, crash reports, or clipboard leakage. In the context of a crypto-funded card workflow, exposure of this key can lead to immediate theft of wallet funds and compromise of any associated accounts.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The documentation tells users to execute a package via npx without pinning an exact version, which means the code fetched and run can change over time. In a wallet setup flow that handles private keys and funds, a compromised, typosquatted, or newly malicious package version could steal credentials or redirect transactions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 85% confidence
Finding: Using an unpinned npx package for the service URL override command still causes remote code to be downloaded and executed without version control. Although this specific example does not include a private key, it trains users to trust mutable package execution in a sensitive financial workflow.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: This command combines unpinned remote package execution with wallet operations, increasing the chance that users run changed code against sensitive assets. If the package version resolved by npx is compromised, it could exfiltrate keys, falsify balances, or manipulate addresses.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.