agent-payment-x402

Pass

Audited by Gen Agent Trust Hub on Apr 6, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Downloads the agentwallet-sdk package from the official NPM registry. The skill correctly emphasizes pinning the version to 6.0.0 to prevent supply-chain attacks from unversioned installs.
  • [COMMAND_EXECUTION]: Executes the npx command to run the wallet SDK as an MCP server. The implementation demonstrates best practices by whitelisting specific environment variables and avoiding the forwarding of the entire parent process environment.
  • [PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection (Category 8) where an agent might be manipulated by malicious external data into initiating unauthorized payments.\n
  • Ingestion points: The agent ingests data from external services during the x402 payment negotiation flow in SKILL.md.\n
  • Boundary markers: No specific delimiters or boundary instructions for untrusted data are provided in the skill instructions.\n
  • Capability inventory: The send_payment tool allows for the transfer of funds to external addresses.\n
  • Sanitization: This is mitigated by requiring the orchestration layer to enforce a SpendingPolicy (per-task/session budgets and recipient allowlists) which the agent cannot modify or escalate.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 6, 2026, 04:00 AM
Security Audit — agent-trust-hub — agent-payment-x402