x402-payments
Pass
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of multiple Node.js packages from NPM, including
@metamask/smart-accounts-kit,@metamask/x402,@x402/core,@x402/fetch,@x402/express,viem,express, andcors. These are either authored by the vendor (MetaMask), the x402 project, or are standard, high-reputation community packages. - [CREDENTIALS_UNSAFE]: The workflow documentation includes code snippets with placeholders for sensitive information, such as
<BUYER_PRIVATE_KEY>,<SESSION_PRIVATE_KEY>, and<SELLER_ADDRESS>. These are used to demonstrate how to initialize accounts and are not hardcoded secrets within the skill itself. - [DATA_EXFILTRATION]: The skill's primary function is to facilitate blockchain payments, which involves sending signed delegation or permission payloads to external URLs (facilitators and seller API endpoints). The facilitator URLs provided in the documentation belong to the
metamask.iodomain, which is the official infrastructure of the skill's author. - [COMMAND_EXECUTION]: The documentation provides standard shell commands for installing dependencies using
npm install. These are intended for the developer to run during setup.
Audit Metadata