AgentPay-via-x402-demo
Warn
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructions direct the agent to store and read unencrypted private keys for EVM and Solana wallets from a local configuration file at ~/.config/x402pay/wallets.json.- [EXTERNAL_DOWNLOADS]: The skill documentation specifies network interactions with an external API at api-pay.agent.tech to initialize payments and verify transaction proofs.- [PROMPT_INJECTION]: The skill instructions advocate for zero human intervention and autonomous execution of financial transactions. Additionally, the skill processes external API responses to construct transaction signatures without defined boundary markers or sanitization logic. Ingestion points: api-pay.agent.tech/api/intents. Boundary markers: Absent. Capability inventory: Local file access, network operations, and cryptographic signing. Sanitization: Absent.- [COMMAND_EXECUTION]: The skill provides code snippets for the agent to install third-party libraries (pip, npm) and execute shell commands (curl) to perform payment operations.
Audit Metadata