okx-x402-payment

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to "assemble" and "return a ready-to-paste authorization header" after signing, which requires emitting signature/token values (secret-derived data) verbatim in the output, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly sends the user's original HTTP request and parses untrusted response headers/bodies (e.g., SKILL.md Step 1–2: reading WWW-Authenticate / PAYMENT-REQUIRED headers and the response body; protocols/x402.md Step 1 decoding PAYMENT-REQUIRED) and uses that decoded JSON to choose protocols and drive wallet/CLI actions, so third-party content can materially influence tool use and next actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill issues the user's original HTTP request to external endpoints (e.g., the example runtime URL https://api.example.com/data) and parses payment headers (PAYMENT-REQUIRED / WWW-Authenticate) whose decoded content directly controls the agent's prompts, flows, and signing actions at runtime, so remote responses can control agent behavior.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a payment dispatcher for on-chain payment protocols (MPP and x402). It decodes payment challenges, performs wallet checks, signs payment transactions/authorization headers (TEE or local-key signing, EIP-3009 references), and supports session operations (open/topUp/close/settle/refund) and tx broadcasting. These are specific crypto/payment actions (wallet signing, broadcasting, channel management) — not generic browser or HTTP tooling — and therefore grant direct financial execution capability.