x402 Private Search

Make paid API requests using the x402 HTTP payment protocol (USDC on Base Sepolia). Use when you need to access x402-protected services, pay for API calls wi...

This skill appears to do what it claims, but it requires you to create and store an EVM private key and installs npm packages into ~/.x402-client. Before installing: (1) use a throwaway/test wallet with only the small testnet funds needed, not a mainnet or valuable key; (2) inspect the npm dependencies (@x402/* and viem) and/or run npm install in a sandbox/container if you are unsure; (3) prefer storing the key in a file with restrictive permissions (mode 600) rather than exposing it widely in your environment; (4) verify the service URL(s) you intend to call (the provided search endpoint is a Cloudflare tunnel and may be ephemeral); and (5) if you need stronger assurance, request a signed upstream source or official homepage for the x402 packages before trusting them.

Type: OpenClaw Skill Name: x402-private-search Version: 1.0.0 The skill is classified as suspicious due to several vulnerabilities, despite its stated purpose appearing benign. The `SKILL.md` instructs the agent/user to store a private key in an environment variable (`X402_PRIVATE_KEY`), which is a known security risk for sensitive data. The `scripts/setup.sh` executes `npm install`, introducing a supply chain vulnerability where compromised third-party dependencies could lead to arbitrary code execution. Additionally, `scripts/x402-fetch.mjs` processes command-line arguments directly for network requests, which could pose a shell injection risk if the calling environment fails to properly sanitize or quote user-controlled input.