中文 EN
Start Review
Skill Trust Decision

x402card-agent

通过 curl|sh 远程脚本执行安装 CLI，声称是钱包管理工具但无本地代码可审计，所有功能依赖外部不可验证的远程脚本。

Install decision first Source: ClawHub Scanned: 23 days ago
Files 2
Artifacts 7
Violations 2
Findings 3
Most direct threat evidence
01
用户阅读 SKILL.md 认为是合法的 x402 虚拟卡管理工具 Entry · SKILL.md
02
按照文档执行 curl -sSL https://x402card.org/install | sh Escalation · SKILL.md
03
远程服务器返回恶意脚本，在用户机器上执行任意代码（如果域名被劫持或服务器被入侵） Impact · https://x402card.org/install

Why this conclusion was reached

3/4 dimensions flagged
Block
Declared vs actual capability

2 undeclared or violating capabilities were inferred.

Block
Hidden execution and egress

1 high-risk artifacts or egress signals were extracted.

Block
Attack chain and severe findings

The report includes 3 attack-chain steps and 2 severe findings.

Review
Dependencies and supply chain hygiene

1 dependency or supply-chain issues need attention.

Attack Chain

01
用户阅读 SKILL.md 认为是合法的 x402 虚拟卡管理工具

Entry · SKILL.md:1

02
按照文档执行 curl -sSL https://x402card.org/install | sh

Escalation · SKILL.md:8

03
远程服务器返回恶意脚本，在用户机器上执行任意代码（如果域名被劫持或服务器被入侵）

Impact · https://x402card.org/install

What drove the risk score up

未声明的远程脚本执行 +25

SKILL.md:8 包含 curl -sSL https://x402card.org/install | sh，伪装成安装命令但实际是远程代码执行

无本地代码可审计 +20

仅有 SKILL.md 文档和 agents/openai.yaml，无任何 scripts/* 文件，声称的功能全部由外部脚本实现

处理财务凭证但无法验证 +15

声称管理 USDC 钱包和虚拟卡凭证，但 CLI 行为完全取决于远程服务器

Most important evidence

High Supply Chain

远程脚本安装绕过本地审计

SKILL.md 指令通过 curl -sSL https://x402card.org/install | sh 安装 CLI，所有功能实现均在远程服务器上，完全无法本地审计代码。攻击者可控制域名或篡改脚本内容，在用户机器上执行任意代码。

SKILL.md:8
要求提供本地脚本源码或使用版本锁定的安装源；优先使用 packages/agent 源码 checkout
High Doc Mismatch

文档声明与实际操作不符

SKILL.md 未在声明部分说明会执行远程脚本下载安装工具，文档声称'credentials must stay out of logs, stdout, files'但无法验证远程 CLI 是否遵循此要求。

SKILL.md:1
在技能声明中明确说明会执行网络下载和 shell 安装操作
Medium Priv Escalation

CLI 配置命令访问敏感环境变量

SKILL.md 提到配置 X402CARD_SIGNER_COMMAND 环境变量用于签名，暗示可能读取敏感凭证路径。

SKILL.md:35
明确说明读取哪些环境变量及其用途

Declared capability vs actual capability

Filesystem Pass
Declared NONE
→
Inferred READ
无本地代码，无法推断实际文件系统操作
Network Block
Declared READ
→
Inferred WRITE
SKILL.md:8 指令通过 curl 下载并管道执行远程脚本
Shell Block
Declared NONE
→
Inferred WRITE
SKILL.md:8 | sh 命令等同于 shell:WRITE
Environment Pass
Declared NONE
→
Inferred READ
CLI 配置 X402CARD_SIGNER_COMMAND 可能读取环境变量

Suspicious artifacts and egress

Critical Dangerous Command
curl -sSL https://x402card.org/install | sh

SKILL.md:8

Medium External URL
https://x402card.org/install

SKILL.md:8

Medium External URL
https://api.x402card.org/api/card/discovery

SKILL.md:12

Medium External URL
https://api.x402card.org/api/agent

SKILL.md:12

Medium External URL
https://api.x402card.org/api/card/purchase

SKILL.md:14

Medium External URL
https://api.x402card.org/api/card/topup/discovery

SKILL.md:22

Medium External URL
https://api.x402card.org/api/card/topup

SKILL.md:24

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
x402card-agent unknown curl|sh remote No 无法审计，远程脚本无版本锁定

File composition

2 files · 37 lines
Markdown 1 files · 33 linesYAML 1 files · 4 lines
Files of concern · 1
SKILL.md Markdown · 33 lines
远程脚本安装绕过本地审计 · 文档声明与实际操作不符 · CLI 配置命令访问敏感环境变量 · curl -sSL https://x402card.org/install | sh · https://x402card.org/install · https://api.x402card.org/api/card/discovery · https://api.x402card.org/api/agent · https://api.x402card.org/api/card/purchase · https://api.x402card.org/api/card/topup/discovery · https://api.x402card.org/api/card/topup
Other files · openai.yaml

Security positives

文档对凭证处理有安全建议（不写入日志/MCP/文件）
提供本地源码 checkout 作为替代方案
使用 idempotency key 防止重复支付