agent-payment-x402
Pass
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Utilizes the
agentwallet-sdkpackage from the npm registry. The documentation correctly identifies potential supply-chain risks and instructs users to pin the package version to6.0.0. - [COMMAND_EXECUTION]: Configures an MCP server via
npxexecution. The provided integration code whitelists environment variables, preventing the exposure of the full system environment to the subprocess. Implementation includes extensive validation of numeric inputs (budget and costs) usingNumber.isFiniteto prevent bypasses. - [PROMPT_INJECTION]: The skill handles external data via the x402 protocol (HTTP 402 negotiation). Potential indirect prompt injection risks from external server responses are mitigated by strict JSON parsing and schema validation shown in the orchestrator examples.
Audit Metadata