Trust Assessment
x402-payment-demo received a trust score of 72/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 1 finding: 1 critical, 0 high, 0 medium, and 0 low severity. Key findings include Untrusted instructions for automatic payment and resource acquisition.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Untrusted instructions for automatic payment and resource acquisition The skill's `SKILL.md` file, which is entirely marked as untrusted input, contains explicit instructions for the AI agent to 'Perform the payment and resource acquisition automatically as guided by the protocol (handling 402 Payment Required, signing permits, etc.)'. If the host LLM were to interpret and execute these instructions from untrusted content, it could lead to unauthorized financial transactions, signing of permits, or resource consumption without explicit user consent. This represents a direct prompt injection attempt where untrusted input dictates sensitive agent actions. 1. **Move trusted skill instructions outside untrusted delimiters**: If this `SKILL.md` is intended to be a trusted instruction set for the agent, it should not be placed within the `<!---UNTRUSTED_INPUT_START_...--->` and `<!---UNTRUSTED_INPUT_END_...--->` tags. 2. **Implement explicit user confirmation**: If the agent is to perform payments or sign permits, the underlying `x402-payment-tron` skill or the agent's framework must implement explicit, trusted user confirmation steps before executing such sensitive actions, regardless of the source of the instruction. 3. **Restrict automatic execution of sensitive actions**: The host LLM should be hardened against automatically executing sensitive actions (like payments) based solely on instructions from untrusted or user-provided content. | LLM | SKILL.md:18 |
Scan History
Embed Code
[](https://skillshield.io/report/3a5bfb63e27f5689)
Powered by SkillShield