x402
Use x402 protocol for HTTP-native crypto payments. Use when Clawdbot needs to pay for APIs, access paid resources, or handle 402 Payment Required responses. Supports USDC payments on Base, Ethereum, and other EVM chains via the x402 standard.
95
Quality
96%
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Advisory
Suggest reviewing before use
Security
2 findings — 2 medium severity. This skill can be installed but you should review these findings before use.
W011: Third-party content exposure detected (indirect prompt injection risk)
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
Third-party content exposure detected (high risk: 1.00). The skill (see SKILL.md examples and scripts/x402-fetch.ts) fetches arbitrary third-party URLs and decodes/acts on untrusted PAYMENT-REQUIRED headers from remote servers to choose networks, amounts, and recipients and to initiate payment retries, so remote content can directly drive tool actions.
W009: Direct money access capability detected (payment gateways, crypto, banking)
What this means
The skill is specifically designed for direct financial operations, giving the agent the ability to move money or execute financial transactions — such as payment processing, cryptocurrency operations, banking integrations, or market order execution.
Why it was flagged
Direct money access detected (high risk: 1.00). This skill is explicitly a payment SDK for crypto stablecoin transfers (x402). It requires a wallet private key, provides client/CLI functions to sign and send payments (npx x402 pay, client.fetch that auto-handles 402 by signing payments, wrapFetch, getBalance), and targets specific networks/tokens (USDC on Base, Ethereum, etc.). Its primary and explicit purpose is to create and send on-chain/payments and manage payment flows — i.e., direct financial execution capability.
- Repository
- Demerzels-lab/elsamultiskillagent
- Commit
45f9fac
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.