agent-payment-x402
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads the
agentwallet-sdkpackage from the official NPM registry. The skill correctly emphasizes pinning the version to6.0.0to prevent supply-chain attacks from unversioned installs. - [COMMAND_EXECUTION]: Executes the
npxcommand to run the wallet SDK as an MCP server. The implementation demonstrates best practices by whitelisting specific environment variables and avoiding the forwarding of the entire parent process environment. - [PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection (Category 8) where an agent might be manipulated by malicious external data into initiating unauthorized payments.\n
- Ingestion points: The agent ingests data from external services during the x402 payment negotiation flow in
SKILL.md.\n - Boundary markers: No specific delimiters or boundary instructions for untrusted data are provided in the skill instructions.\n
- Capability inventory: The
send_paymenttool allows for the transfer of funds to external addresses.\n - Sanitization: This is mitigated by requiring the orchestration layer to enforce a
SpendingPolicy(per-task/session budgets and recipient allowlists) which the agent cannot modify or escalate.
Audit Metadata