pay-for-service
Warn
Audited by Gen Agent Trust Hub on Feb 19, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- COMMAND_EXECUTION (MEDIUM): The skill constructs bash commands (e.g.,
fdx call getX402Content --url <url>) by interpolating the URL parameter. If the input URL is not strictly sanitized, an attacker can execute arbitrary shell commands using metacharacters such as;,&&, or backticks. - DATA_EXFILTRATION (MEDIUM): While the skill is intended for payments, a malicious prompt or indirect injection could trick the agent into authorizing payments to an attacker-controlled endpoint, effectively exfiltrating financial assets.
- PROMPT_INJECTION (LOW): The skill is vulnerable to Indirect Prompt Injection (Category 8).
- Ingestion points: Untrusted data enters the agent context via the
--urlparameter in thegetX402Contentcommand. - Boundary markers: Absent. There are no delimiters or instructions provided to the agent to ignore instructions embedded in the fetched content.
- Capability inventory: The skill has access to
fdx callfor financial transactions and sensitive wallet information viagetWalletOverview. - Sanitization: Absent. The skill does not describe any validation or escaping of the content retrieved from the remote URL before returning it to the human or processing it further.
Audit Metadata