agent-payment-x402

Pass

Audited by Gen Agent Trust Hub on Jul 29, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the agentwallet-sdk package from the NPM registry and references official documentation and repositories from OKX and GitHub. These are recognized as reputable technology providers.
  • [CREDENTIALS_UNSAFE]: The skill provides clear instructions and code examples for the secure handling of private keys using environment variables. It includes specific defensive measures such as validating key presence before execution and limiting environment variable exposure to subprocesses.
  • [PROMPT_INJECTION]: The skill provides a framework for processing payment-related data from external APIs. 1. Ingestion points: Agent context receives HTTP 402 payment negotiation data and headers from external services. 2. Boundary markers: The skill explicitly recommends that spending policies be defined by the orchestrator to prevent agents from escalating their own limits. 3. Capability inventory: The skill provides specific tools for wallet balance (get_balance), payment execution (send_payment), and auditing (list_transactions, check_spending). 4. Sanitization: Code examples demonstrate robust sanitization of payment costs and response parsing to prevent malicious data from bypassing budget controls.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 29, 2026, 08:20 AM