Security Audit

x402_payment_demo

github.com/openclaw/skills

AI SkillCommit 13146e6a3d46

TRUSTED

Scanned 2 months ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

x402_payment_demo received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.

SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Skill requests highly sensitive TRON private key.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

100%

Dependency Graph

100%

LLM Behavioral Safety

85%

Behavioral Risk Signals

Network Access

1 finding

Excessive Permissions

1 finding

Security Findings1

Severity	Finding	Layer	Location
HIGH	Skill requests highly sensitive TRON private key The skill's manifest explicitly declares a requirement for the `TRON_PRIVATE_KEY` environment variable. This is a highly sensitive credential that grants full control over a TRON wallet. While the skill's description in SKILL.md mentions its use for the x402 payment protocol and 'signing permits,' the request for such a powerful key constitutes an excessive permission. Without the skill's source code, it's impossible to verify if the key is handled securely or if its use is strictly confined to the stated purpose, posing a significant risk of unauthorized transactions or fund loss if the skill is compromised or malicious. Review the necessity of direct private key access. Consider using a more granular permission model, such as delegated signing services or limited-scope API keys, if available. Ensure robust security practices for handling and storing the key within the skill's implementation, including encryption and strict access controls. If direct private key access is unavoidable, implement thorough auditing and logging of all key usage.	LLM	SKILL.md

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/ea6a5a8a8a3245f0.svg)](https://skillshield.io/report/ea6a5a8a8a3245f0)