Use this skill when the user wants to purchase a virtual debit card using crypto, create a prepaid card via x402 protocol, check virtual card status, or set up an EVM wallet for card payments. Trigger on: "buy a card", "get a virtual card", "create card", "card status", "setup wallet for card", or any intent involving purchasing virtual Visa/Mastercard with cryptocurrency.

• Analyzed: Apr 2, 2026, 10:46 AM
• Findings: 1
• Version: 1.0.0
• Hash: c893d6056ada438cf81e8c483ad7e58ad3dfd49372af8c9e79f676c2f7bf4e87
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill manages sensitive EVM private keys and executes remote code via 'npx @aeon-ai-pay/x402-card', which presents a high risk of credential theft if the remote package is compromised. It explicitly instructs the AI agent to solicit the user's private key and store it in a local configuration file (~/.x402-card/config.json), while also mandating background 'auto-upgrades' via the same npx package. While these actions are consistent with the stated goal of facilitating crypto-based virtual card purchases, the combination of handling raw secrets and executing unpinned remote code is a significant security risk.