T09 · Insecure Skill Coding Practices
Error
- Location
src/monitor.ts:50- Finding
Shell Command Injection in TypeScript Wallet Operations
- Content
View full analysis
config.maxDailySpend) { console.log(`⚠️ Daily spend limit would be exceeded ($${dailySpend} + $${config.topUpAmount} > $${config.maxDailySpend})`); return false; } try { console.log(`⛽ Topping up: $${config.topUpAmount} ${config.currency} on ${config.chain}...`); const output = execSync( `mp buy --amount ${config.topUpAmount} --currency ${config.currency} --chain ${config.chain} --json`, { encoding: 'utf-8', timeout: 60000 } ); ``` ```ts export async function handleX402( url: string, paymentHeader: string, config?: FuelConfig ): Promise<{ paid: boolean; amount: number }> { const cfg = config || loadConfig(); if (!cfg.x402Enabled) { return { paid: false, amount: 0 }; } try { // Parse payment requirements from header const requirements = JSON.parse(Buffer.from(paymentHeader, 'base64').toString()); const amount = parseFloat(requirements.amount); if (amount > cfg.x402MaxPerRequest) { console.log(`⚠️ x402 payment $${amount} exceeds max per request $${cfg.x402MaxPerRequest}`); return { paid: false, amount }; } // Check daily limit const dailySpend = getDailySpend(); if (dailySpend + amount > cfg.maxDailySpend) { return { paid: false, amount }; } // Execute payment via MoonPay wallet const output = execSync( `mp send --to ${requirements.payTo} --amou ...[truncated 1871 chars]- Remediation
View remediation