{"data":{"skill":{"slug":"x402socks-x402socks","name":"x402socks","icon":"📦","repo":"https://github.com/x402socks/skill/tree/e5f9bc9d6386307fc7373825225f6fc48c7e045f/skills/x402socks","status":"approved","author":"x402socks","authorVersion":"1.2.4","skillstoreRevision":5,"license":"MIT"},"licenseCorrection":null,"audit":{"id":"8f5f0214-4b40-443f-9d5f-5cf2568c60c8","skill_id":"3af4d1b6-6993-408f-9f04-0f96b511a58d","version":5,"content_hash":"v3:9938f91a9ab0f5763a54332b129295339bf829dd:ced61fec573263b6f1d5775c4ab05005ca68f1e4b5b1b29a885d5d38b47f997f:df16939866aea38d963a9cab8979f6e442536fde8f9390072a50fd1412d2ad9e:736b696c6c732f78343032736f636b732f78343032736f636b73:cb2ac9a881770d71134173d43f1ef08d","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"Most flags describe intended proxy operations, Markdown, or protected credential handling; no evidence found of credential harvesting or prompt injection. The opt-in legacy transport branch exposes reusable tokens without encryption. Rotation also invalidates the old token before local storage checks, risking loss of paid access.","remediation":[{"issue":"Opt-in SOCKS5 and plaintext CONNECT expose reusable proxy tokens to network observers.","severity":"high","suggestion":"Remove public plaintext authentication modes or require an encrypted tunnel to the exit. Keep certificate-verified TLS CONNECT as the supported default."},{"issue":"Token rotation commits remotely before the replacement destination is validated.","severity":"medium","suggestion":"Validate the token directory and reserve a private writable staging file before rotating. Preserve replacement credentials privately if final persistence fails."}],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"README.md","line_end":5,"line_start":5},{"file":"README.md","line_end":59,"line_start":59},{"file":"references/endpoints.md","line_end":194,"line_start":194},{"file":"references/endpoints.md","line_end":194,"line_start":194},{"file":"references/endpoints.md","line_end":214,"line_start":214},{"file":"references/endpoints.md","line_end":22,"line_start":22},{"file":"references/endpoints.md","line_end":53,"line_start":53},{"file":"references/endpoints.md","line_end":109,"line_start":109},{"file":"references/endpoints.md","line_end":172,"line_start":172},{"file":"references/endpoints.md","line_end":176,"line_start":176},{"file":"references/endpoints.md","line_end":191,"line_start":191},{"file":"references/endpoints.md","line_end":194,"line_start":194},{"file":"references/endpoints.md","line_end":210,"line_start":210},{"file":"references/endpoints.md","line_end":214,"line_start":214},{"file":"references/endpoints.md","line_end":235,"line_start":235},{"file":"references/endpoints.md","line_end":245,"line_start":245},{"file":"references/endpoints.md","line_end":27,"line_start":27},{"file":"references/endpoints.md","line_end":34,"line_start":34},{"file":"references/endpoints.md","line_end":218,"line_start":218},{"file":"references/endpoints.md","line_end":222,"line_start":222},{"file":"references/endpoints.md","line_end":224,"line_start":224},{"file":"references/endpoints.md","line_end":235,"line_start":235},{"file":"references/endpoints.md","line_end":253,"line_start":253},{"file":"references/endpoints.md","line_end":261,"line_start":261},{"file":"references/payments.md","line_end":8,"line_start":8},{"file":"references/payments.md","line_end":25,"line_start":25},{"file":"references/payments.md","line_end":159,"line_start":159},{"file":"references/payments.md","line_end":209,"line_start":209},{"file":"references/troubleshooting.md","line_end":14,"line_start":14},{"file":"references/troubleshooting.md","line_end":28,"line_start":28},{"file":"references/troubleshooting.md","line_end":39,"line_start":39},{"file":"references/troubleshooting.md","line_end":40,"line_start":40},{"file":"scripts/x402socks.sh","line_end":10,"line_start":10},{"file":"scripts/x402socks.sh","line_end":11,"line_start":11},{"file":"scripts/x402socks.sh","line_end":12,"line_start":12},{"file":"scripts/x402socks.sh","line_end":17,"line_start":17},{"file":"scripts/x402socks.sh","line_end":23,"line_start":23},{"file":"scripts/x402socks.sh","line_end":24,"line_start":24},{"file":"scripts/x402socks.sh","line_end":64,"line_start":64},{"file":"scripts/x402socks.sh","line_end":65,"line_start":65},{"file":"scripts/x402socks.sh","line_end":408,"line_start":408},{"file":"scripts/x402socks.sh","line_end":414,"line_start":414},{"file":"scripts/x402socks.sh","line_end":430,"line_start":430},{"file":"scripts/x402socks.sh","line_end":433,"line_start":433},{"file":"scripts/x402socks.sh","line_end":166,"line_start":166},{"file":"scripts/x402socks.sh","line_end":192,"line_start":192},{"file":"scripts/x402socks.sh","line_end":382,"line_start":382},{"file":"scripts/x402socks.sh","line_end":390,"line_start":390},{"file":"scripts/x402socks.sh","line_end":410,"line_start":410},{"file":"scripts/x402socks.sh","line_end":416,"line_start":416}]},{"factor":"filesystem","evidence":[{"file":"README.md","line_end":32,"line_start":32},{"file":"README.md","line_end":33,"line_start":33},{"file":"README.md","line_end":52,"line_start":52},{"file":"README.md","line_end":32,"line_start":32},{"file":"README.md","line_end":33,"line_start":33},{"file":"README.md","line_end":52,"line_start":52},{"file":"references/endpoints.md","line_end":203,"line_start":203},{"file":"references/endpoints.md","line_end":207,"line_start":207},{"file":"references/endpoints.md","line_end":228,"line_start":228},{"file":"references/endpoints.md","line_end":231,"line_start":231},{"file":"references/endpoints.md","line_end":174,"line_start":174},{"file":"references/endpoints.md","line_end":187,"line_start":187},{"file":"references/endpoints.md","line_end":10,"line_start":10},{"file":"references/endpoints.md","line_end":15,"line_start":15},{"file":"references/endpoints.md","line_end":108,"line_start":108},{"file":"references/endpoints.md","line_end":174,"line_start":174},{"file":"references/endpoints.md","line_end":187,"line_start":187},{"file":"references/endpoints.md","line_end":207,"line_start":207},{"file":"references/endpoints.md","line_end":231,"line_start":231},{"file":"references/endpoints.md","line_end":106,"line_start":106},{"file":"references/endpoints.md","line_end":170,"line_start":170},{"file":"references/payments.md","line_end":270,"line_start":270},{"file":"references/payments.md","line_end":270,"line_start":270},{"file":"scripts/x402socks.sh","line_end":173,"line_start":173},{"file":"scripts/x402socks.sh","line_end":48,"line_start":48},{"file":"scripts/x402socks.sh","line_end":173,"line_start":173},{"file":"scripts/x402socks.sh","line_end":35,"line_start":35},{"file":"scripts/x402socks.sh","line_end":40,"line_start":40},{"file":"scripts/x402socks.sh","line_end":41,"line_start":41},{"file":"scripts/x402socks.sh","line_end":255,"line_start":255},{"file":"scripts/x402socks.sh","line_end":337,"line_start":337},{"file":"scripts/x402socks.sh","line_end":426,"line_start":426},{"file":"scripts/x402socks.sh","line_end":98,"line_start":98},{"file":"scripts/x402socks.sh","line_end":132,"line_start":132},{"file":"scripts/x402socks.sh","line_end":134,"line_start":134},{"file":"scripts/x402socks.sh","line_end":125,"line_start":125},{"file":"scripts/x402socks.sh","line_end":143,"line_start":143},{"file":"SKILL.md","line_end":82,"line_start":82},{"file":"SKILL.md","line_end":115,"line_start":115},{"file":"SKILL.md","line_end":82,"line_start":82},{"file":"SKILL.md","line_end":115,"line_start":115}]},{"factor":"external_commands","evidence":[{"file":"references/endpoints.md","line_end":211,"line_start":207},{"file":"references/endpoints.md","line_end":211,"line_start":211},{"file":"references/endpoints.md","line_end":240,"line_start":231},{"file":"references/endpoints.md","line_end":106,"line_start":106},{"file":"references/endpoints.md","line_end":170,"line_start":170},{"file":"references/endpoints.md","line_end":174,"line_start":174},{"file":"references/payments.md","line_end":145,"line_start":106},{"file":"references/payments.md","line_end":163,"line_start":145},{"file":"references/payments.md","line_end":167,"line_start":163},{"file":"scripts/x402socks.sh","line_end":91,"line_start":91},{"file":"scripts/x402socks.sh","line_end":62,"line_start":62},{"file":"scripts/x402socks.sh","line_end":70,"line_start":70},{"file":"scripts/x402socks.sh","line_end":80,"line_start":80},{"file":"scripts/x402socks.sh","line_end":95,"line_start":95},{"file":"scripts/x402socks.sh","line_end":96,"line_start":96},{"file":"scripts/x402socks.sh","line_end":257,"line_start":255},{"file":"scripts/x402socks.sh","line_end":262,"line_start":260},{"file":"scripts/x402socks.sh","line_end":312,"line_start":312},{"file":"scripts/x402socks.sh","line_end":317,"line_start":317},{"file":"scripts/x402socks.sh","line_end":324,"line_start":324},{"file":"scripts/x402socks.sh","line_end":325,"line_start":325},{"file":"scripts/x402socks.sh","line_end":326,"line_start":326},{"file":"scripts/x402socks.sh","line_end":333,"line_start":333},{"file":"scripts/x402socks.sh","line_end":334,"line_start":334},{"file":"scripts/x402socks.sh","line_end":335,"line_start":335},{"file":"scripts/x402socks.sh","line_end":337,"line_start":336},{"file":"scripts/x402socks.sh","line_end":349,"line_start":349},{"file":"scripts/x402socks.sh","line_end":351,"line_start":351},{"file":"scripts/x402socks.sh","line_end":422,"line_start":422},{"file":"scripts/x402socks.sh","line_end":423,"line_start":423},{"file":"scripts/x402socks.sh","line_end":424,"line_start":424},{"file":"scripts/x402socks.sh","line_end":426,"line_start":425},{"file":"scripts/x402socks.sh","line_end":429,"line_start":428},{"file":"scripts/x402socks.sh","line_end":429,"line_start":429},{"file":"scripts/x402socks.sh","line_end":430,"line_start":430},{"file":"scripts/x402socks.sh","line_end":440,"line_start":440},{"file":"scripts/x402socks.sh","line_end":450,"line_start":450},{"file":"scripts/x402socks.sh","line_end":459,"line_start":456},{"file":"scripts/x402socks.sh","line_end":463,"line_start":463},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":33,"line_start":19},{"file":"SKILL.md","line_end":39,"line_start":33},{"file":"SKILL.md","line_end":47,"line_start":39},{"file":"SKILL.md","line_end":48,"line_start":47},{"file":"SKILL.md","line_end":49,"line_start":48},{"file":"SKILL.md","line_end":55,"line_start":49},{"file":"SKILL.md","line_end":56,"line_start":55},{"file":"SKILL.md","line_end":57,"line_start":56},{"file":"SKILL.md","line_end":58,"line_start":57},{"file":"SKILL.md","line_end":59,"line_start":58}]},{"factor":"env_access","evidence":[{"file":"references/payments.md","line_end":90,"line_start":90},{"file":"references/payments.md","line_end":91,"line_start":91},{"file":"references/payments.md","line_end":92,"line_start":92},{"file":"references/payments.md","line_end":93,"line_start":93},{"file":"references/payments.md","line_end":94,"line_start":94},{"file":"references/payments.md","line_end":95,"line_start":95},{"file":"references/payments.md","line_end":145,"line_start":145},{"file":"references/payments.md","line_end":90,"line_start":90},{"file":"references/payments.md","line_end":91,"line_start":91},{"file":"references/payments.md","line_end":92,"line_start":92},{"file":"references/payments.md","line_end":93,"line_start":93},{"file":"references/payments.md","line_end":94,"line_start":94},{"file":"references/payments.md","line_end":95,"line_start":95},{"file":"references/payments.md","line_end":145,"line_start":145},{"file":"references/payments.md","line_end":145,"line_start":145}]}],"critical_findings":[],"high_findings":[{"title":"Hardcoded URL","locations":[{"file":"scripts/x402socks.sh","line_end":414,"line_start":414}],"confidence":0.99,"description":"proxy=\"http://$exit_id.x402socks.com:3128\"","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"This branch selects an HTTP proxy that receives the reusable authentication token without encryption. Explicit opt-in limits activation but cannot prevent network interception."},{"title":"SOCKS proxy","locations":[{"file":"scripts/x402socks.sh","line_end":390,"line_start":390}],"confidence":0.99,"description":"--socks5)    mode=\"socks5\" ;;","review_kind":"capability","source_category":"network","source_severity":"high","confidence_reasoning":"The opt-in legacy branch sends the reusable proxy token without transport encryption. A network observer can capture it and consume paid access."},{"title":"SOCKS proxy","locations":[{"file":"scripts/x402socks.sh","line_end":410,"line_start":410}],"confidence":0.99,"description":"plaintext|socks5)","review_kind":"capability","source_category":"network","source_severity":"high","confidence_reasoning":"The opt-in legacy branch sends the reusable proxy token without transport encryption. A network observer can capture it and consume paid access."},{"title":"SOCKS proxy","locations":[{"file":"scripts/x402socks.sh","line_end":416,"line_start":416}],"confidence":0.99,"description":"proxy=\"socks5h://$exit_id.x402socks.com:1080\"","review_kind":"capability","source_category":"network","source_severity":"high","confidence_reasoning":"The opt-in legacy branch sends the reusable proxy token without transport encryption. A network observer can capture it and consume paid access."}],"medium_findings":[{"title":"Rotation Invalidates Access Before Local Storage Is Validated","locations":[{"file":"scripts/x402socks.sh","line_end":352,"line_start":346},{"file":"scripts/x402socks.sh","line_end":127,"line_start":96},{"file":"scripts/x402socks.sh","line_end":150,"line_start":129}],"confidence":0.98,"description":"Rotation invalidates the old token before the writer checks directory ownership, permissions, symlinks, or writability. A storage failure discards the one-time replacement and interrupts paid access until wallet-based recovery.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The remote rotation request precedes all writer checks, and the documented API immediately invalidates the old token. Writer errors exit without preserving the replacement."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":7,"total_lines":1367,"audit_model":"codex","audited_at":"2026-11-08T23:05:27.095+00:00","created_at":"2026-11-09T16:02:40.266723+00:00","static_findings":[{"id":"network:README.md:5:socks-proxy","file":"README.md","pattern":"SOCKS proxy","snippet":"is the default transport; SOCKS5 and plaintext CONNECT are opt-in.","category":"network","line_end":5,"severity":"high","line_start":5},{"id":"network:README.md:59:socks-proxy","file":"README.md","pattern":"SOCKS proxy","snippet":"offers it (`eu-north1`, `asia-central2`, `asia-west1`). SOCKS5 and plaintext","category":"network","line_end":59,"severity":"high","line_start":59},{"id":"filesystem:README.md:32:hidden-file-in-home-directory","file":"README.md","pattern":"Hidden file in home directory","snippet":"cp -r skills/x402socks ~/.claude/skills/       # Claude Code","category":"filesystem","line_end":32,"severity":"high","line_start":32},{"id":"filesystem:README.md:33:hidden-file-in-home-directory","file":"README.md","pattern":"Hidden file in home directory","snippet":"cp -r skills/x402socks ~/.agents/skills/       # OpenCode and other clients","category":"filesystem","line_end":33,"severity":"high","line_start":33},{"id":"filesystem:README.md:52:hidden-file-in-home-directory","file":"README.md","pattern":"Hidden file in home directory","snippet":"(`~/.config/x402socks/token`) and passes it to curl on stdin, so it never","category":"filesystem","line_end":52,"severity":"high","line_start":52},{"id":"filesystem:README.md:32:hidden-file-access","file":"README.md","pattern":"Hidden file access","snippet":"cp -r skills/x402socks ~/.claude/skills/       # Claude Code","category":"filesystem","line_end":32,"severity":"medium","line_start":32},{"id":"filesystem:README.md:33:hidden-file-access","file":"README.md","pattern":"Hidden file access","snippet":"cp -r skills/x402socks ~/.agents/skills/       # OpenCode and other clients","category":"filesystem","line_end":33,"severity":"medium","line_start":33},{"id":"filesystem:README.md:52:hidden-file-access","file":"README.md","pattern":"Hidden file access","snippet":"(`~/.config/x402socks/token`) and passes it to curl on stdin, so it never","category":"filesystem","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:references/endpoints.md:207:ruby-shell-backtick-execution","file":"references/endpoints.md","pattern":"Ruby/shell backtick execution","snippet":"const t = readFileSync(`${homedir()}/.config/x402socks/token`, \"utf8\").trim();","category":"external_commands","line_end":211,"severity":"medium","line_start":207},{"id":"external_commands:references/endpoints.md:211:ruby-shell-backtick-execution","file":"references/endpoints.md","pattern":"Ruby/shell backtick execution","snippet":"token: `Basic ${Buffer.from(`${t}:${t}`).toString(\"base64\")}`,","category":"external_commands","line_end":211,"severity":"medium","line_start":211},{"id":"external_commands:references/endpoints.md:231:ruby-shell-backtick-execution","file":"references/endpoints.md","pattern":"Ruby/shell backtick execution","snippet":"const t = readFileSync(`${homedir()}/.config/x402socks/token`, \"utf8\").trim();","category":"external_commands","line_end":240,"severity":"medium","line_start":231},{"id":"external_commands:references/endpoints.md:106:shell-command-substitution","file":"references/endpoints.md","pattern":"Shell command substitution","snippet":"payload=\"$(mktemp)\"; trap 'rm -f \"$payload\"' EXIT","category":"external_commands","line_end":106,"severity":"medium","line_start":106},{"id":"external_commands:references/endpoints.md:170:shell-command-substitution","file":"references/endpoints.md","pattern":"Shell command substitution","snippet":"cfg=\"$(mktemp)\"; trap 'rm -f \"$cfg\"' EXIT","category":"external_commands","line_end":170,"severity":"medium","line_start":170},{"id":"external_commands:references/endpoints.md:174:shell-command-substitution","file":"references/endpoints.md","pattern":"Shell command substitution","snippet":"\"$(cat ~/.config/x402socks/token)\" \"$(cat ~/.config/x402socks/token)\"","category":"external_commands","line_end":174,"severity":"medium","line_start":174},{"id":"network:references/endpoints.md:194:http-https-request","file":"references/endpoints.md","pattern":"HTTP/HTTPS request","snippet":"print(http.request(\"GET\", \"https://api.ipify.org\").data.decode())","category":"network","line_end":194,"severity":"low","line_start":194},{"id":"network:references/endpoints.md:194:http-client-library","file":"references/endpoints.md","pattern":"HTTP client library","snippet":"print(http.request(\"GET\", \"https://api.ipify.org\").data.decode())","category":"network","line_end":194,"severity":"low","line_start":194},{"id":"network:references/endpoints.md:214:http-client-library","file":"references/endpoints.md","pattern":"HTTP client library","snippet":"const { body } = await request(\"https://api.ipify.org\", { dispatcher });","category":"network","line_end":214,"severity":"low","line_start":214},{"id":"network:references/endpoints.md:22:hardcoded-url","file":"references/endpoints.md","pattern":"Hardcoded URL","snippet":"https://<exit>.x402socks.com:3129","category":"network","line_end":22,"severity":"low","line_start":22},{"id":"network:references/endpoints.md:53:hardcoded-url","file":"references/endpoints.md","pattern":"Hardcoded URL","snippet":"\"hostname\": \"https://us-central1.x402socks.com\",","category":"network","line_end":53,"severity":"low","line_start":53},{"id":"network:references/endpoints.md:109:hardcoded-url","file":"references/endpoints.md","pattern":"Hardcoded URL","snippet":"curl -sS -X POST https://x402socks.com/api/token/status \\","category":"network","line_end":109,"severity":"low","line_start":109},{"id":"network:references/endpoints.md:172:hardcoded-url","file":"references/endpoints.md","pattern":"Hardcoded URL","snippet":"printf 'proxy = \"https://eu-north1.x402socks.com:3129\"\\n'","category":"network","line_end":172,"severity":"low","line_start":172},{"id":"network:references/endpoints.md:176:hardcoded-url","file":"references/endpoints.md","pattern":"Hardcoded URL","snippet":"curl --config \"$cfg\" https://api.ipify.org","category":"network","line_end":176,"severity":"low","line_start":176},{"id":"network:references/endpoints.md:191:hardcoded-url","file":"references/endpoints.md","pattern":"Hardcoded URL","snippet":"\"https://eu-north1.x402socks.com:3129\",","category":"network","line_end":191,"severity":"low","line_start":191},{"id":"network:references/endpoints.md:194:hardcoded-url","file":"references/endpoints.md","pattern":"Hardcoded URL","snippet":"print(http.request(\"GET\", \"https://api.ipify.org\").data.decode())","category":"network","line_end":194,"severity":"low","line_start":194},{"id":"network:references/endpoints.md:210:hardcoded-url","file":"references/endpoints.md","pattern":"Hardcoded URL","snippet":"uri: \"https://eu-north1.x402socks.com:3129\",","category":"network","line_end":210,"severity":"low","line_start":210},{"id":"network:references/endpoints.md:214:hardcoded-url","file":"references/endpoints.md","pattern":"Hardcoded URL","snippet":"const { body } = await request(\"https://api.ipify.org\", { dispatcher });","category":"network","line_end":214,"severity":"low","line_start":214},{"id":"network:references/endpoints.md:235:hardcoded-url","file":"references/endpoints.md","pattern":"Hardcoded URL","snippet":"server: \"https://eu-north1.x402socks.com:3129\", // TLS CONNECT, not SOCKS5","category":"network","line_end":235,"severity":"low","line_start":235},{"id":"network:references/endpoints.md:245:hardcoded-url","file":"references/endpoints.md","pattern":"Hardcoded URL","snippet":"--proxy-server=https://eu-north1.x402socks.com:3129","category":"network","line_end":245,"severity":"low","line_start":245},{"id":"network:references/endpoints.md:27:socks-proxy","file":"references/endpoints.md","pattern":"SOCKS proxy","snippet":"**SOCKS5 on 1080** is the primary protocol and is available on every exit. **TLS HTTP CONNECT on 312","category":"network","line_end":27,"severity":"high","line_start":27},{"id":"network:references/endpoints.md:34:socks-proxy","file":"references/endpoints.md","pattern":"SOCKS proxy","snippet":"| SOCKS5 | `socks5h://<exit>.x402socks.com:1080` | Every exit |","category":"network","line_end":34,"severity":"high","line_start":34},{"id":"network:references/endpoints.md:218:socks-proxy","file":"references/endpoints.md","pattern":"SOCKS proxy","snippet":"undici's `ProxyAgent` speaks HTTP CONNECT, not SOCKS5.","category":"network","line_end":218,"severity":"high","line_start":218},{"id":"network:references/endpoints.md:222:socks-proxy","file":"references/endpoints.md","pattern":"SOCKS proxy","snippet":"Chromium cannot authenticate to a SOCKS5 proxy, and Playwright's","category":"network","line_end":222,"severity":"high","line_start":222},{"id":"network:references/endpoints.md:224:socks-proxy","file":"references/endpoints.md","pattern":"SOCKS proxy","snippet":"`socks5://` entry with credentials fails before it connects. Use the TLS HTTP","category":"network","line_end":224,"severity":"high","line_start":224},{"id":"network:references/endpoints.md:235:socks-proxy","file":"references/endpoints.md","pattern":"SOCKS proxy","snippet":"server: \"https://eu-north1.x402socks.com:3129\", // TLS CONNECT, not SOCKS5","category":"network","line_end":235,"severity":"high","line_start":235},{"id":"network:references/endpoints.md:253:socks-proxy","file":"references/endpoints.md","pattern":"SOCKS proxy","snippet":"The helper exposes both under `test --plaintext` / `test --socks5` with","category":"network","line_end":253,"severity":"high","line_start":253},{"id":"network:references/endpoints.md:261:socks-proxy","file":"references/endpoints.md","pattern":"SOCKS proxy","snippet":"- The proxy endpoints expect the token in SOCKS5 RFC 1929 or `Proxy-Authorization`, never in a query","category":"network","line_end":261,"severity":"high","line_start":261},{"id":"filesystem:references/endpoints.md:203:synchronous-file-operations","file":"references/endpoints.md","pattern":"Synchronous file operations","snippet":"import { readFileSync } from \"node:fs\";","category":"filesystem","line_end":203,"severity":"medium","line_start":203},{"id":"filesystem:references/endpoints.md:207:synchronous-file-operations","file":"references/endpoints.md","pattern":"Synchronous file operations","snippet":"const t = readFileSync(`${homedir()}/.config/x402socks/token`, \"utf8\").trim();","category":"filesystem","line_end":207,"severity":"medium","line_start":207},{"id":"filesystem:references/endpoints.md:228:synchronous-file-operations","file":"references/endpoints.md","pattern":"Synchronous file operations","snippet":"import { readFileSync } from \"node:fs\";","category":"filesystem","line_end":228,"severity":"medium","line_start":228},{"id":"filesystem:references/endpoints.md:231:synchronous-file-operations","file":"references/endpoints.md","pattern":"Synchronous file operations","snippet":"const t = readFileSync(`${homedir()}/.config/x402socks/token`, \"utf8\").trim();","category":"filesystem","line_end":231,"severity":"medium","line_start":231},{"id":"filesystem:references/endpoints.md:174:hidden-file-in-home-directory","file":"references/endpoints.md","pattern":"Hidden file in home directory","snippet":"\"$(cat ~/.config/x402socks/token)\" \"$(cat ~/.config/x402socks/token)\"","category":"filesystem","line_end":174,"severity":"high","line_start":174},{"id":"filesystem:references/endpoints.md:187:hidden-file-in-home-directory","file":"references/endpoints.md","pattern":"Hidden file in home directory","snippet":"token = open(os.path.expanduser(\"~/.config/x402socks/token\")).read().strip()","category":"filesystem","line_end":187,"severity":"high","line_start":187},{"id":"filesystem:references/endpoints.md:10:hidden-file-access","file":"references/endpoints.md","pattern":"Hidden file access","snippet":"| GET    | `https://x402socks.com/.well-known/x402`   | Static payment metadata                  |","category":"filesystem","line_end":10,"severity":"medium","line_start":10},{"id":"filesystem:references/endpoints.md:15:hidden-file-access","file":"references/endpoints.md","pattern":"Hidden file access","snippet":"`/.well-known/x402` is a static summary. The live `PAYMENT-REQUIRED` header on a 402 is authoritativ","category":"filesystem","line_end":15,"severity":"medium","line_start":15},{"id":"filesystem:references/endpoints.md:108:hidden-file-access","file":"references/endpoints.md","pattern":"Hidden file access","snippet":"\"$HOME/.config/x402socks/token\" > \"$payload\"","category":"filesystem","line_end":108,"severity":"medium","line_start":108},{"id":"filesystem:references/endpoints.md:174:hidden-file-access","file":"references/endpoints.md","pattern":"Hidden file access","snippet":"\"$(cat ~/.config/x402socks/token)\" \"$(cat ~/.config/x402socks/token)\"","category":"filesystem","line_end":174,"severity":"medium","line_start":174},{"id":"filesystem:references/endpoints.md:187:hidden-file-access","file":"references/endpoints.md","pattern":"Hidden file access","snippet":"token = open(os.path.expanduser(\"~/.config/x402socks/token\")).read().strip()","category":"filesystem","line_end":187,"severity":"medium","line_start":187},{"id":"filesystem:references/endpoints.md:207:hidden-file-access","file":"references/endpoints.md","pattern":"Hidden file access","snippet":"const t = readFileSync(`${homedir()}/.config/x402socks/token`, \"utf8\").trim();","category":"filesystem","line_end":207,"severity":"medium","line_start":207},{"id":"filesystem:references/endpoints.md:231:hidden-file-access","file":"references/endpoints.md","pattern":"Hidden file access","snippet":"const t = readFileSync(`${homedir()}/.config/x402socks/token`, \"utf8\").trim();","category":"filesystem","line_end":231,"severity":"medium","line_start":231},{"id":"filesystem:references/endpoints.md:106:temp-file-creation","file":"references/endpoints.md","pattern":"Temp file creation","snippet":"payload=\"$(mktemp)\"; trap 'rm -f \"$payload\"' EXIT","category":"filesystem","line_end":106,"severity":"low","line_start":106},{"id":"filesystem:references/endpoints.md:170:temp-file-creation","file":"references/endpoints.md","pattern":"Temp file creation","snippet":"cfg=\"$(mktemp)\"; trap 'rm -f \"$cfg\"' EXIT","category":"filesystem","line_end":170,"severity":"low","line_start":170},{"id":"blocker:references/endpoints.md:53:system-reconnaissance","file":"references/endpoints.md","pattern":"System reconnaissance","snippet":"\"hostname\": \"https://us-central1.x402socks.com\",","category":"blocker","line_end":53,"severity":"low","line_start":53},{"id":"blocker:references/endpoints.md:133:system-reconnaissance","file":"references/endpoints.md","pattern":"System reconnaissance","snippet":"Success: `200 {\"account\":{...},\"token\":\"NEW_TOKEN\"}`. The old token stops working immediately, for t","category":"blocker","line_end":133,"severity":"low","line_start":133},{"id":"external_commands:references/payments.md:106:ruby-shell-backtick-execution","file":"references/payments.md","pattern":"Ruby/shell backtick execution","snippet":"throw new Error(\"missing approved terms; run `quote` and record its output\");","category":"external_commands","line_end":145,"severity":"medium","line_start":106},{"id":"external_commands:references/payments.md:145:ruby-shell-backtick-execution","file":"references/payments.md","pattern":"Ruby/shell backtick execution","snippet":"process.env.EVM_PRIVATE_KEY as `0x${string}`,","category":"external_commands","line_end":163,"severity":"medium","line_start":145},{"id":"external_commands:references/payments.md:163:ruby-shell-backtick-execution","file":"references/payments.md","pattern":"Ruby/shell backtick execution","snippet":"if (!res.ok) throw new Error(`purchase failed: ${res.status}`);","category":"external_commands","line_end":167,"severity":"medium","line_start":163},{"id":"network:references/payments.md:8:hardcoded-url","file":"references/payments.md","pattern":"Hardcoded URL","snippet":"curl -i -X POST https://payments.x402socks.com/v1/access/time_6h \\","category":"network","line_end":8,"severity":"low","line_start":8},{"id":"network:references/payments.md:25:hardcoded-url","file":"references/payments.md","pattern":"Hardcoded URL","snippet":"\"url\": \"https://payments.x402socks.com/v1/access\",","category":"network","line_end":25,"severity":"low","line_start":25},{"id":"network:references/payments.md:159:hardcoded-url","file":"references/payments.md","pattern":"Hardcoded URL","snippet":"\"https://payments.x402socks.com/v1/access/time_6h\",","category":"network","line_end":159,"severity":"low","line_start":159},{"id":"network:references/payments.md:209:hardcoded-url","file":"references/payments.md","pattern":"Hardcoded URL","snippet":"r = httpx.post(\"https://payments.x402socks.com/v1/access/time_6h\", json={})","category":"network","line_end":209,"severity":"low","line_start":209},{"id":"filesystem:references/payments.md:270:hidden-file-in-home-directory","file":"references/payments.md","pattern":"Hidden file in home directory","snippet":"read -r SIGNATURE < ~/.config/x402socks/recovery.sig","category":"filesystem","line_end":270,"severity":"high","line_start":270},{"id":"filesystem:references/payments.md:270:hidden-file-access","file":"references/payments.md","pattern":"Hidden file access","snippet":"read -r SIGNATURE < ~/.config/x402socks/recovery.sig","category":"filesystem","line_end":270,"severity":"medium","line_start":270},{"id":"env_access:references/payments.md:90:environment-variable-access-dot-notation","file":"references/payments.md","pattern":"Environment variable access (dot notation)","snippet":"network: process.env.X402_APPROVED_NETWORK ?? \"\",","category":"env_access","line_end":90,"severity":"low","line_start":90},{"id":"env_access:references/payments.md:91:environment-variable-access-dot-notation","file":"references/payments.md","pattern":"Environment variable access (dot notation)","snippet":"asset: process.env.X402_APPROVED_ASSET ?? \"\",","category":"env_access","line_end":91,"severity":"low","line_start":91},{"id":"env_access:references/payments.md:92:environment-variable-access-dot-notation","file":"references/payments.md","pattern":"Environment variable access (dot notation)","snippet":"payTo: process.env.X402_APPROVED_PAY_TO ?? \"\",","category":"env_access","line_end":92,"severity":"low","line_start":92},{"id":"env_access:references/payments.md:93:environment-variable-access-dot-notation","file":"references/payments.md","pattern":"Environment variable access (dot notation)","snippet":"assetName: process.env.X402_APPROVED_ASSET_NAME ?? \"\",","category":"env_access","line_end":93,"severity":"low","line_start":93},{"id":"env_access:references/payments.md:94:environment-variable-access-dot-notation","file":"references/payments.md","pattern":"Environment variable access (dot notation)","snippet":"assetVersion: process.env.X402_APPROVED_ASSET_VERSION ?? \"\",","category":"env_access","line_end":94,"severity":"low","line_start":94},{"id":"env_access:references/payments.md:95:environment-variable-access-dot-notation","file":"references/payments.md","pattern":"Environment variable access (dot notation)","snippet":"maxAmountAtomic: BigInt(process.env.X402_APPROVED_MAX_ATOMIC ?? \"0\"),","category":"env_access","line_end":95,"severity":"low","line_start":95},{"id":"env_access:references/payments.md:145:environment-variable-access-dot-notation","file":"references/payments.md","pattern":"Environment variable access (dot notation)","snippet":"process.env.EVM_PRIVATE_KEY as `0x${string}`,","category":"env_access","line_end":145,"severity":"low","line_start":145},{"id":"env_access:references/payments.md:90:environment-variable-object","file":"references/payments.md","pattern":"Environment variable object","snippet":"network: process.env.X402_APPROVED_NETWORK ?? \"\",","category":"env_access","line_end":90,"severity":"low","line_start":90},{"id":"env_access:references/payments.md:91:environment-variable-object","file":"references/payments.md","pattern":"Environment variable object","snippet":"asset: process.env.X402_APPROVED_ASSET ?? \"\",","category":"env_access","line_end":91,"severity":"low","line_start":91},{"id":"env_access:references/payments.md:92:environment-variable-object","file":"references/payments.md","pattern":"Environment variable object","snippet":"payTo: process.env.X402_APPROVED_PAY_TO ?? \"\",","category":"env_access","line_end":92,"severity":"low","line_start":92},{"id":"env_access:references/payments.md:93:environment-variable-object","file":"references/payments.md","pattern":"Environment variable object","snippet":"assetName: process.env.X402_APPROVED_ASSET_NAME ?? \"\",","category":"env_access","line_end":93,"severity":"low","line_start":93},{"id":"env_access:references/payments.md:94:environment-variable-object","file":"references/payments.md","pattern":"Environment variable object","snippet":"assetVersion: process.env.X402_APPROVED_ASSET_VERSION ?? \"\",","category":"env_access","line_end":94,"severity":"low","line_start":94},{"id":"env_access:references/payments.md:95:environment-variable-object","file":"references/payments.md","pattern":"Environment variable object","snippet":"maxAmountAtomic: BigInt(process.env.X402_APPROVED_MAX_ATOMIC ?? \"0\"),","category":"env_access","line_end":95,"severity":"low","line_start":95},{"id":"env_access:references/payments.md:145:environment-variable-object","file":"references/payments.md","pattern":"Environment variable object","snippet":"process.env.EVM_PRIVATE_KEY as `0x${string}`,","category":"env_access","line_end":145,"severity":"low","line_start":145},{"id":"env_access:references/payments.md:145:generic-api-secret-keys","file":"references/payments.md","pattern":"Generic API/secret keys","snippet":"process.env.EVM_PRIVATE_KEY as `0x${string}`,","category":"env_access","line_end":145,"severity":"high","line_start":145},{"id":"sensitive:references/payments.md:90:environment-file-access","file":"references/payments.md","pattern":"Environment file access","snippet":"network: process.env.X402_APPROVED_NETWORK ?? \"\",","category":"sensitive","line_end":90,"severity":"high","line_start":90},{"id":"sensitive:references/payments.md:91:environment-file-access","file":"references/payments.md","pattern":"Environment file access","snippet":"asset: process.env.X402_APPROVED_ASSET ?? \"\",","category":"sensitive","line_end":91,"severity":"high","line_start":91},{"id":"sensitive:references/payments.md:92:environment-file-access","file":"references/payments.md","pattern":"Environment file access","snippet":"payTo: process.env.X402_APPROVED_PAY_TO ?? \"\",","category":"sensitive","line_end":92,"severity":"high","line_start":92},{"id":"sensitive:references/payments.md:93:environment-file-access","file":"references/payments.md","pattern":"Environment file access","snippet":"assetName: process.env.X402_APPROVED_ASSET_NAME ?? \"\",","category":"sensitive","line_end":93,"severity":"high","line_start":93},{"id":"sensitive:references/payments.md:94:environment-file-access","file":"references/payments.md","pattern":"Environment file access","snippet":"assetVersion: process.env.X402_APPROVED_ASSET_VERSION ?? \"\",","category":"sensitive","line_end":94,"severity":"high","line_start":94},{"id":"sensitive:references/payments.md:95:environment-file-access","file":"references/payments.md","pattern":"Environment file access","snippet":"maxAmountAtomic: BigInt(process.env.X402_APPROVED_MAX_ATOMIC ?? \"0\"),","category":"sensitive","line_end":95,"severity":"high","line_start":95},{"id":"sensitive:references/payments.md:145:environment-file-access","file":"references/payments.md","pattern":"Environment file access","snippet":"process.env.EVM_PRIVATE_KEY as `0x${string}`,","category":"sensitive","line_end":145,"severity":"high","line_start":145},{"id":"sensitive:references/payments.md:84:crypto-seed-private-key-mention","file":"references/payments.md","pattern":"Crypto seed/private key mention","snippet":"import { privateKeyToAccount } from \"viem/accounts\";","category":"sensitive","line_end":84,"severity":"high","line_start":84},{"id":"sensitive:references/payments.md:144:crypto-seed-private-key-mention","file":"references/payments.md","pattern":"Crypto seed/private key mention","snippet":"const account = privateKeyToAccount(","category":"sensitive","line_end":144,"severity":"high","line_start":144},{"id":"blocker:references/payments.md:291:system-reconnaissance","file":"references/payments.md","pattern":"System reconnaissance","snippet":"| `410 plan_expired`          | paid plan expired; no automatic catch-up                   |","category":"blocker","line_end":291,"severity":"low","line_start":291},{"id":"network:references/troubleshooting.md:14:socks-proxy","file":"references/troubleshooting.md","pattern":"SOCKS proxy","snippet":"it. SOCKS5 (1080) and plaintext CONNECT (3128) require","category":"network","line_end":14,"severity":"high","line_start":14},{"id":"network:references/troubleshooting.md:28:socks-proxy","file":"references/troubleshooting.md","pattern":"SOCKS proxy","snippet":"| SOCKS5 auth rejected / connection closed early | token wrong, expired, or already rotated         ","category":"network","line_end":28,"severity":"high","line_start":28},{"id":"network:references/troubleshooting.md:39:socks-proxy","file":"references/troubleshooting.md","pattern":"SOCKS proxy","snippet":"| Target logs your local DNS resolver            | used `socks5://` instead of `socks5h://`         ","category":"network","line_end":39,"severity":"high","line_start":39},{"id":"network:references/troubleshooting.md:40:socks-proxy","file":"references/troubleshooting.md","pattern":"SOCKS proxy","snippet":"| Works in curl, fails in Playwright/Chromium    | Chromium cannot authenticate to SOCKS5; Playwrigh","category":"network","line_end":40,"severity":"high","line_start":40},{"id":"blocker:references/troubleshooting.md:22:system-reconnaissance","file":"references/troubleshooting.md","pattern":"System reconnaissance","snippet":"| `Could not resolve proxy`                      | typo in hostname, or exit host does not exist    ","category":"blocker","line_end":22,"severity":"low","line_start":22},{"id":"blocker:references/troubleshooting.md:25:system-reconnaissance","file":"references/troubleshooting.md","pattern":"System reconnaissance","snippet":"| TLS handshake / certificate error on 3129     | exit cert expired or hostname mismatch            ","category":"blocker","line_end":25,"severity":"low","line_start":25},{"id":"blocker:references/troubleshooting.md:34:system-reconnaissance","file":"references/troubleshooting.md","pattern":"System reconnaissance","snippet":"| `404 package_not_found`                        | package id not in the public catalog             ","category":"blocker","line_end":34,"severity":"low","line_start":34},{"id":"blocker:references/troubleshooting.md:36:system-reconnaissance","file":"references/troubleshooting.md","pattern":"System reconnaissance","snippet":"| `403 ownership_not_proven` on recover          | signed with a different wallet than the one that ","category":"blocker","line_end":36,"severity":"low","line_start":36},{"id":"external_commands:scripts/x402socks.sh:91:ruby-shell-backtick-execution","file":"scripts/x402socks.sh","pattern":"Ruby/shell backtick execution","snippet":"# The parser uses `python3 -c` on purpose: a heredoc would replace stdin, so the","category":"external_commands","line_end":91,"severity":"medium","line_start":91},{"id":"external_commands:scripts/x402socks.sh:62:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"cfg=\"$(cat)\"","category":"external_commands","line_end":62,"severity":"medium","line_start":62},{"id":"external_commands:scripts/x402socks.sh:70:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"printf 'url = \"%s\"\\n' \"$(cfg_escape \"$url\")\"","category":"external_commands","line_end":70,"severity":"medium","line_start":70},{"id":"external_commands:scripts/x402socks.sh:80:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"file=\"$(token_file)\"","category":"external_commands","line_end":80,"severity":"medium","line_start":80},{"id":"external_commands:scripts/x402socks.sh:95:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"file=\"$(token_file)\"","category":"external_commands","line_end":95,"severity":"medium","line_start":95},{"id":"external_commands:scripts/x402socks.sh:96:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"mkdir -p \"$(dirname \"$file\")\"","category":"external_commands","line_end":96,"severity":"medium","line_start":96},{"id":"external_commands:scripts/x402socks.sh:255:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"hdr=\"$(req -D - -o /dev/null -X POST \"$PAY/v1/access/$pkg\" \\","category":"external_commands","line_end":257,"severity":"medium","line_start":255},{"id":"external_commands:scripts/x402socks.sh:260:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"decoded=\"$(printf '%s' \"$hdr\" | python3 -c '","category":"external_commands","line_end":262,"severity":"medium","line_start":260},{"id":"external_commands:scripts/x402socks.sh:312:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"token=\"$(tr -d '\\r\\n')\"","category":"external_commands","line_end":312,"severity":"medium","line_start":312},{"id":"external_commands:scripts/x402socks.sh:317:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"body=\"$(printf '%s' \"$token\" | json_token_body)\"","category":"external_commands","line_end":317,"severity":"medium","line_start":317},{"id":"external_commands:scripts/x402socks.sh:324:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"token=\"$(resolve_token)\"","category":"external_commands","line_end":324,"severity":"medium","line_start":324},{"id":"external_commands:scripts/x402socks.sh:325:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"body=\"$(printf '%s' \"$token\" | json_token_body)\"","category":"external_commands","line_end":325,"severity":"medium","line_start":325},{"id":"external_commands:scripts/x402socks.sh:326:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"cfg=\"$(printf 'header = \"content-type: application/json\"\\ndata = \"%s\"' \"$(cfg_escape \"$body\")\")\"","category":"external_commands","line_end":326,"severity":"medium","line_start":326},{"id":"external_commands:scripts/x402socks.sh:333:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"token=\"$(resolve_token)\"","category":"external_commands","line_end":333,"severity":"medium","line_start":333},{"id":"external_commands:scripts/x402socks.sh:334:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"body=\"$(printf '%s' \"$token\" | json_token_body)\"","category":"external_commands","line_end":334,"severity":"medium","line_start":334},{"id":"external_commands:scripts/x402socks.sh:335:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"cfg=\"$(printf 'header = \"content-type: application/json\"\\ndata = \"%s\"' \"$(cfg_escape \"$body\")\")\"","category":"external_commands","line_end":335,"severity":"medium","line_start":335},{"id":"external_commands:scripts/x402socks.sh:336:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"code=\"$(printf '%s' \"$cfg\" | req_secret \"$WEB/api/token/validate\" \\","category":"external_commands","line_end":337,"severity":"medium","line_start":336},{"id":"external_commands:scripts/x402socks.sh:349:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"token=\"$(resolve_token)\"","category":"external_commands","line_end":349,"severity":"medium","line_start":349},{"id":"external_commands:scripts/x402socks.sh:351:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"cfg=\"$(printf 'header = \"Authorization: Bearer %s\"' \"$(cfg_escape \"$token\")\")\"","category":"external_commands","line_end":351,"severity":"medium","line_start":351},{"id":"external_commands:scripts/x402socks.sh:422:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"token=\"$(resolve_token)\"","category":"external_commands","line_end":422,"severity":"medium","line_start":422},{"id":"external_commands:scripts/x402socks.sh:423:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"body=\"$(printf '%s' \"$token\" | json_token_body)\"","category":"external_commands","line_end":423,"severity":"medium","line_start":423},{"id":"external_commands:scripts/x402socks.sh:424:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"cfg=\"$(printf 'header = \"content-type: application/json\"\\ndata = \"%s\"' \"$(cfg_escape \"$body\")\")\"","category":"external_commands","line_end":424,"severity":"medium","line_start":424},{"id":"external_commands:scripts/x402socks.sh:425:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"code=\"$(printf '%s' \"$cfg\" | req_secret \"$WEB/api/token/validate\" \\","category":"external_commands","line_end":426,"severity":"medium","line_start":425},{"id":"external_commands:scripts/x402socks.sh:428:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"cfg=\"$(printf 'proxy = \"%s\"\\nproxy-user = \"%s:%s\"' \\","category":"external_commands","line_end":429,"severity":"medium","line_start":428},{"id":"external_commands:scripts/x402socks.sh:429:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"\"$(cfg_escape \"$proxy\")\" \"$(cfg_escape \"$token\")\" \"$(cfg_escape \"$token\")\")\"","category":"external_commands","line_end":429,"severity":"medium","line_start":429},{"id":"external_commands:scripts/x402socks.sh:430:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"ip=\"$(printf '%s' \"$cfg\" | req_secret https://api.ipify.org)\" \\","category":"external_commands","line_end":430,"severity":"medium","line_start":430},{"id":"external_commands:scripts/x402socks.sh:440:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"issued_at=\"$(date +%s)\"","category":"external_commands","line_end":440,"severity":"medium","line_start":440},{"id":"external_commands:scripts/x402socks.sh:450:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"tx=\"$1\"; issued_at=\"${2:-$(date +%s)}\"","category":"external_commands","line_end":450,"severity":"medium","line_start":450},{"id":"external_commands:scripts/x402socks.sh:456:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"body=\"$(","category":"external_commands","line_end":459,"severity":"medium","line_start":456},{"id":"external_commands:scripts/x402socks.sh:463:shell-command-substitution","file":"scripts/x402socks.sh","pattern":"Shell command substitution","snippet":"cfg=\"$(printf 'header = \"content-type: application/json\"\\ndata = \"%s\"' \"$(cfg_escape \"$body\")\")\"","category":"external_commands","line_end":463,"severity":"medium","line_start":463},{"id":"network:scripts/x402socks.sh:10:hardcoded-url","file":"scripts/x402socks.sh","pattern":"Hardcoded URL","snippet":"WEB=\"${X402SOCKS_WEB:-https://x402socks.com}\"","category":"network","line_end":10,"severity":"low","line_start":10},{"id":"network:scripts/x402socks.sh:11:hardcoded-url","file":"scripts/x402socks.sh","pattern":"Hardcoded URL","snippet":"PAY=\"${X402SOCKS_PAY:-https://payments.x402socks.com}\"","category":"network","line_end":11,"severity":"low","line_start":11},{"id":"network:scripts/x402socks.sh:12:hardcoded-url","file":"scripts/x402socks.sh","pattern":"Hardcoded URL","snippet":"API=\"${X402SOCKS_API:-https://api.x402socks.com}\"","category":"network","line_end":12,"severity":"low","line_start":12},{"id":"network:scripts/x402socks.sh:17:hardcoded-url","file":"scripts/x402socks.sh","pattern":"Hardcoded URL","snippet":"# Credential-bearing requests must target https://. A plaintext URL (for","category":"network","line_end":17,"severity":"low","line_start":17},{"id":"network:scripts/x402socks.sh:23:hardcoded-url","file":"scripts/x402socks.sh","pattern":"Hardcoded URL","snippet":"https://*) return 0 ;;","category":"network","line_end":23,"severity":"low","line_start":23},{"id":"network:scripts/x402socks.sh:24:hardcoded-url","file":"scripts/x402socks.sh","pattern":"Hardcoded URL","snippet":"http://*)","category":"network","line_end":24,"severity":"low","line_start":24},{"id":"network:scripts/x402socks.sh:64:hardcoded-url","file":"scripts/x402socks.sh","pattern":"Hardcoded URL","snippet":"https://*) proto=(--proto '=https' --proto-redir '=https') ;;","category":"network","line_end":64,"severity":"low","line_start":64},{"id":"network:scripts/x402socks.sh:65:hardcoded-url","file":"scripts/x402socks.sh","pattern":"Hardcoded URL","snippet":"http://*)  proto=(--proto '=http,https' --proto-redir '=http,https') ;;","category":"network","line_end":65,"severity":"low","line_start":65},{"id":"network:scripts/x402socks.sh:408:hardcoded-url","file":"scripts/x402socks.sh","pattern":"Hardcoded URL","snippet":"proxy=\"https://$exit_id.x402socks.com:3129\"","category":"network","line_end":408,"severity":"low","line_start":408},{"id":"network:scripts/x402socks.sh:414:hardcoded-url","file":"scripts/x402socks.sh","pattern":"Hardcoded URL","snippet":"proxy=\"http://$exit_id.x402socks.com:3128\"","category":"network","line_end":414,"severity":"low","line_start":414},{"id":"network:scripts/x402socks.sh:430:hardcoded-url","file":"scripts/x402socks.sh","pattern":"Hardcoded URL","snippet":"ip=\"$(printf '%s' \"$cfg\" | req_secret https://api.ipify.org)\" \\","category":"network","line_end":430,"severity":"low","line_start":430},{"id":"network:scripts/x402socks.sh:433:hardcoded-url","file":"scripts/x402socks.sh","pattern":"Hardcoded URL","snippet":"note \"compare with your direct IP: curl -s https://api.ipify.org\"","category":"network","line_end":433,"severity":"low","line_start":433},{"id":"network:scripts/x402socks.sh:166:socks-proxy","file":"scripts/x402socks.sh","pattern":"SOCKS proxy","snippet":"test [--tls|--plaintext|--socks5] [exit_id]","category":"network","line_end":166,"severity":"high","line_start":166},{"id":"network:scripts/x402socks.sh:192:socks-proxy","file":"scripts/x402socks.sh","pattern":"SOCKS proxy","snippet":"X402SOCKS_ALLOW_PLAINTEXT=1   required for SOCKS5 1080 and plaintext CONNECT 3128","category":"network","line_end":192,"severity":"high","line_start":192},{"id":"network:scripts/x402socks.sh:382:socks-proxy","file":"scripts/x402socks.sh","pattern":"SOCKS proxy","snippet":"# token is not sent in cleartext. SOCKS5 (1080) and plaintext CONNECT (3128)","category":"network","line_end":382,"severity":"high","line_start":382},{"id":"network:scripts/x402socks.sh:390:socks-proxy","file":"scripts/x402socks.sh","pattern":"SOCKS proxy","snippet":"--socks5)    mode=\"socks5\" ;;","category":"network","line_end":390,"severity":"high","line_start":390},{"id":"network:scripts/x402socks.sh:410:socks-proxy","file":"scripts/x402socks.sh","pattern":"SOCKS proxy","snippet":"plaintext|socks5)","category":"network","line_end":410,"severity":"high","line_start":410},{"id":"network:scripts/x402socks.sh:416:socks-proxy","file":"scripts/x402socks.sh","pattern":"SOCKS proxy","snippet":"proxy=\"socks5h://$exit_id.x402socks.com:1080\"","category":"network","line_end":416,"severity":"high","line_start":416},{"id":"filesystem:scripts/x402socks.sh:173:hidden-file-in-home-directory","file":"scripts/x402socks.sh","pattern":"Hidden file in home directory","snippet":"X402SOCKS_TOKEN_FILE  token file (default ~/.config/x402socks/token, mode 600)","category":"filesystem","line_end":173,"severity":"high","line_start":173},{"id":"filesystem:scripts/x402socks.sh:48:hidden-file-access","file":"scripts/x402socks.sh","pattern":"Hidden file access","snippet":"printf '%s' \"${X402SOCKS_TOKEN_FILE:-${XDG_CONFIG_HOME:-$HOME/.config}/x402socks/token}\"","category":"filesystem","line_end":48,"severity":"medium","line_start":48},{"id":"filesystem:scripts/x402socks.sh:173:hidden-file-access","file":"scripts/x402socks.sh","pattern":"Hidden file access","snippet":"X402SOCKS_TOKEN_FILE  token file (default ~/.config/x402socks/token, mode 600)","category":"filesystem","line_end":173,"severity":"medium","line_start":173},{"id":"filesystem:scripts/x402socks.sh:35:standard-device-file-access","file":"scripts/x402socks.sh","pattern":"Standard device file access","snippet":"need() { command -v \"$1\" >/dev/null 2>&1 || die \"$1 is required\"; }","category":"filesystem","line_end":35,"severity":"low","line_start":35},{"id":"filesystem:scripts/x402socks.sh:40:standard-device-file-access","file":"scripts/x402socks.sh","pattern":"Standard device file access","snippet":"if command -v python3 >/dev/null 2>&1; then","category":"filesystem","line_end":40,"severity":"low","line_start":40},{"id":"filesystem:scripts/x402socks.sh:41:standard-device-file-access","file":"scripts/x402socks.sh","pattern":"Standard device file access","snippet":"python3 -m json.tool 2>/dev/null || cat","category":"filesystem","line_end":41,"severity":"low","line_start":41},{"id":"filesystem:scripts/x402socks.sh:255:standard-device-file-access","file":"scripts/x402socks.sh","pattern":"Standard device file access","snippet":"hdr=\"$(req -D - -o /dev/null -X POST \"$PAY/v1/access/$pkg\" \\","category":"filesystem","line_end":255,"severity":"low","line_start":255},{"id":"filesystem:scripts/x402socks.sh:337:standard-device-file-access","file":"scripts/x402socks.sh","pattern":"Standard device file access","snippet":"-X POST -o /dev/null -w '%{http_code}')\"","category":"filesystem","line_end":337,"severity":"low","line_start":337},{"id":"filesystem:scripts/x402socks.sh:426:standard-device-file-access","file":"scripts/x402socks.sh","pattern":"Standard device file access","snippet":"-o /dev/null -w '%{http_code}')\"","category":"filesystem","line_end":426,"severity":"low","line_start":426},{"id":"filesystem:scripts/x402socks.sh:98:temp-file-creation","file":"scripts/x402socks.sh","pattern":"Temp file creation","snippet":"import json, os, sys, tempfile","category":"filesystem","line_end":98,"severity":"low","line_start":98},{"id":"filesystem:scripts/x402socks.sh:132:temp-file-creation","file":"scripts/x402socks.sh","pattern":"Temp file creation","snippet":"fd, tmp = tempfile.mkstemp(prefix=\".token.\", dir=directory)","category":"filesystem","line_end":132,"severity":"low","line_start":132},{"id":"filesystem:scripts/x402socks.sh:134:python-file-write-append","file":"scripts/x402socks.sh","pattern":"Python file write/append","snippet":"with os.fdopen(fd, \"w\") as fh:","category":"filesystem","line_end":134,"severity":"medium","line_start":134},{"id":"filesystem:scripts/x402socks.sh:125:python-os-file-operations","file":"scripts/x402socks.sh","pattern":"Python os file operations","snippet":"os.chmod(directory, 0o700)","category":"filesystem","line_end":125,"severity":"medium","line_start":125},{"id":"filesystem:scripts/x402socks.sh:143:python-os-file-operations","file":"scripts/x402socks.sh","pattern":"Python os file operations","snippet":"os.unlink(tmp)","category":"filesystem","line_end":143,"severity":"medium","line_start":143},{"id":"obfuscation:scripts/x402socks.sh:267:python-base64-decode","file":"scripts/x402socks.sh","pattern":"Python base64 decode","snippet":"data = json.loads(base64.b64decode(raw))","category":"obfuscation","line_end":267,"severity":"medium","line_start":267},{"id":"sensitive:scripts/x402socks.sh:115:certificate-key-files","file":"scripts/x402socks.sh","pattern":"Certificate/key files","snippet":"% (\", \".join(sorted(data.keys())) or \"none\")","category":"sensitive","line_end":115,"severity":"high","line_start":115},{"id":"blocker:scripts/x402socks.sh:107:system-reconnaissance","file":"scripts/x402socks.sh","pattern":"System reconnaissance","snippet":"sys.exit(\"response was not valid JSON; nothing was saved\")","category":"blocker","line_end":107,"severity":"low","line_start":107},{"id":"blocker:scripts/x402socks.sh:114:system-reconnaissance","file":"scripts/x402socks.sh","pattern":"System reconnaissance","snippet":"\"response did not include a token; nothing was saved (fields: %s)\"","category":"blocker","line_end":114,"severity":"low","line_start":114},{"id":"blocker:scripts/x402socks.sh:122:system-reconnaissance","file":"scripts/x402socks.sh","pattern":"System reconnaissance","snippet":"if st.st_uid != os.getuid() or (st.st_mode & 0o022):","category":"blocker","line_end":122,"severity":"low","line_start":122},{"id":"blocker:scripts/x402socks.sh:214:system-reconnaissance","file":"scripts/x402socks.sh","pattern":"System reconnaissance","snippet":"n[\"id\"], n[\"hostname\"], n[\"port\"], n[\"health\"], n.get(\"label\", \"\")))","category":"blocker","line_end":214,"severity":"low","line_start":214},{"id":"blocker:scripts/x402socks.sh:342:system-reconnaissance","file":"scripts/x402socks.sh","pattern":"System reconnaissance","snippet":"note \"invalid (HTTP $code)\"","category":"blocker","line_end":342,"severity":"low","line_start":342},{"id":"blocker:scripts/x402socks.sh:356:system-reconnaissance","file":"scripts/x402socks.sh","pattern":"System reconnaissance","snippet":"# config line, then confirm the id is present and usable in the live feed.","category":"blocker","line_end":356,"severity":"low","line_start":356},{"id":"blocker:scripts/x402socks.sh:366:system-reconnaissance","file":"scripts/x402socks.sh","pattern":"System reconnaissance","snippet":"valid_exit_id \"$want\" || die \"invalid exit id '$want' (lowercase letters, digits, hyphen only)\"","category":"blocker","line_end":366,"severity":"low","line_start":366},{"id":"blocker:scripts/x402socks.sh:377:system-reconnaissance","file":"scripts/x402socks.sh","pattern":"System reconnaissance","snippet":"sys.exit(\"unknown exit id %s; re-read /nodes.json\" % want)","category":"blocker","line_end":377,"severity":"low","line_start":377},{"id":"blocker:scripts/x402socks.sh:394:system-reconnaissance","file":"scripts/x402socks.sh","pattern":"System reconnaissance","snippet":"[ \"$have_exit\" -eq 0 ] || die \"only one exit id may be given\"","category":"blocker","line_end":394,"severity":"low","line_start":394},{"id":"blocker:scripts/x402socks.sh:404:system-reconnaissance","file":"scripts/x402socks.sh","pattern":"System reconnaissance","snippet":"check_exit_id \"$exit_id\"","category":"blocker","line_end":404,"severity":"low","line_start":404},{"id":"blocker:scripts/x402socks.sh:427:system-reconnaissance","file":"scripts/x402socks.sh","pattern":"System reconnaissance","snippet":"[ \"$code\" = \"204\" ] || die \"token invalid before test (HTTP $code)\"","category":"blocker","line_end":427,"severity":"low","line_start":427},{"id":"blocker:scripts/x402socks.sh:431:system-reconnaissance","file":"scripts/x402socks.sh","pattern":"System reconnaissance","snippet":"|| die \"egress failed via $exit_id ($mode)\"","category":"blocker","line_end":431,"severity":"low","line_start":431},{"id":"blocker:scripts/x402socks.sh:443:system-reconnaissance","file":"scripts/x402socks.sh","pattern":"System reconnaissance","snippet":"printf '\\n\\nissued_at: %s (valid +/-10 minutes)\\n' \"$issued_at\" >&2","category":"blocker","line_end":443,"severity":"low","line_start":443},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"The default transport is **TLS HTTP CONNECT on port 3129**, available on `eu-north1`, `asia-central2","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":33,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":39,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Look up the price in `/catalog.json`.","category":"external_commands","line_end":47,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"abort before signing. `scripts/x402socks.sh quote <package_id>` prints the live","category":"external_commands","line_end":48,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"amount and exits non-zero when it exceeds `X402SOCKS_MAX_USDC`. Client-side","category":"external_commands","line_end":49,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"guards for the TypeScript and Python libraries are in `references/payments.md`.","category":"external_commands","line_end":55,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `time_6h`     | $1.00  | 6 hours, 1 GB, all exits, 1 session           |","category":"external_commands","line_end":56,"severity":"medium","line_start":55},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `time_1d`     | $3.59  | 1 day, 10 GB, all exits, 1 session            |","category":"external_commands","line_end":57,"severity":"medium","line_start":56},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `time_7d`     | $9.99  | 7 days, 75 GB, all exits, 1 session           |","category":"external_commands","line_end":58,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `usage_5gb`   | $6.99  | 5 GB, no time limit, all exits, 1 session     |","category":"external_commands","line_end":59,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `usage_50gb`  | $34.99 | 50 GB, no time limit, all exits, 1 session    |","category":"external_commands","line_end":60,"severity":"medium","line_start":59},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `multi_agent` | $29.99 | 30 days, 300 GB (fair use), all exits, 5 agents |","category":"external_commands","line_end":62,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Always re-read `/catalog.json` at buy time — the table above is a snapshot, not a contract.","category":"external_commands","line_end":64,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Choosing:** time-boxed plans suit a single burst; the `usage_*` plans suit intermittent jobs that ","category":"external_commands","line_end":64,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. **Verify the service.** `GET /api/health` must return `{\"status\":\"ok\"}`. If a chosen exit is down","category":"external_commands","line_end":68,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Quote the price** from `/catalog.json` and get user approval (see spending rule). Then re-read ","category":"external_commands","line_end":70,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **Request access.** `POST https://payments.x402socks.com/v1/access/{package_id}` with `{}`. Expec","category":"external_commands","line_end":70,"severity":"medium","line_start":70},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. **Pay and retry.** Compare the live `accepts[]` against the exact terms the user approved — schem","category":"external_commands","line_end":71,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"7. **Validate** with `POST /api/token/status` before debugging anything else. A dead token and a dea","category":"external_commands","line_end":78,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":85,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":89,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Every exit offers **SOCKS5 on TCP 1080** as the primary protocol. `eu-north1`, `asia-central2`, and ","category":"external_commands","line_end":89,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `us-central1`   | US Texas              | yes         | no       |","category":"external_commands","line_end":94,"severity":"medium","line_start":93},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `us-east1`      | US New York           | yes         | no       |","category":"external_commands","line_end":95,"severity":"medium","line_start":94},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `us-west1`      | US California         | yes         | no       |","category":"external_commands","line_end":96,"severity":"medium","line_start":95},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `eu-central1`   | EU Paris              | yes         | no       |","category":"external_commands","line_end":97,"severity":"medium","line_start":96},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `eu-north1`     | EU Riga               | yes         | **yes**  |","category":"external_commands","line_end":98,"severity":"medium","line_start":97},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `asia-central1` | APAC China (Hong Kong) | yes         | no       |","category":"external_commands","line_end":99,"severity":"medium","line_start":98},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `asia-central2` | APAC Singapore        | yes         | **yes**  |","category":"external_commands","line_end":100,"severity":"medium","line_start":99},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `asia-west1`    | APAC India            | yes         | **yes**  |","category":"external_commands","line_end":102,"severity":"medium","line_start":100},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Plaintext HTTP CONNECT on **3128** is supported only for browser compatibility (Chrome and similar) ","category":"external_commands","line_end":104,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":109,"severity":"medium","line_start":104},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":111,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Client snippets for curl, Python, Node, Playwright, and Chrome are in `references/endpoints.md`. If ","category":"external_commands","line_end":111,"severity":"medium","line_start":111},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- The token is a secret. Store it in a file with mode `0600` (`X402SOCKS_TOKEN_FILE`, default `~/.co","category":"external_commands","line_end":115,"severity":"medium","line_start":115},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Never pass the token as a command argument. `curl --proxy-user \"$TOKEN:$TOKEN\"` and `-H \"Authoriza","category":"external_commands","line_end":116,"severity":"medium","line_start":116},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Rotate on any suspicion of exposure: `scripts/x402socks.sh rotate`. Rotation invalidates the old t","category":"external_commands","line_end":119,"severity":"medium","line_start":119},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Credential-bearing requests only ever go to `https://` endpoints. The helper rejects a plaintext `","category":"external_commands","line_end":120,"severity":"medium","line_start":120},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Rotate** (you still hold the token): `POST https://api.x402socks.com/api/v1/token/rotate` with t","category":"external_commands","line_end":124,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Recover** (payment settled, token lost): `POST https://payments.x402socks.com/v1/access/recover`","category":"external_commands","line_end":125,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Node membership changes without notice. `/nodes.json` carries disabled and unhealthy entries along","category":"external_commands","line_end":130,"severity":"medium","line_start":130},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Entitlements say \"1 active session\" on single packages. Do not assume unlimited parallelism; use `","category":"external_commands","line_end":134,"severity":"medium","line_start":131},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Amounts in the 402 challenge are atomic USDC units (6 decimals): `\"1000000\"` is $1.00. Do not conf","category":"external_commands","line_end":136,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Support is a Telegram channel (`https://t.me/x402socks`), not a ticket queue.","category":"external_commands","line_end":140,"severity":"medium","line_start":136},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `references/payments.md` — full x402 v2 purchase flow, TypeScript and Python code, credential reco","category":"external_commands","line_end":141,"severity":"medium","line_start":140},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `references/endpoints.md` — every endpoint, request/response shapes, client snippets.","category":"external_commands","line_end":142,"severity":"medium","line_start":141},{"id":"network:SKILL.md:8:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"homepage: https://x402socks.com","category":"network","line_end":8,"severity":"low","line_start":8},{"id":"network:SKILL.md:21:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -s https://x402socks.com/api/health          # {\"status\":\"ok\",...}","category":"network","line_end":21,"severity":"low","line_start":21},{"id":"network:SKILL.md:22:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"curl -s https://x402socks.com/nodes.json          # keep nodes where disabled == false","category":"network","line_end":22,"severity":"low","line_start":22},{"id":"network:SKILL.md:70:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"3. **Request access.** `POST https://payments.x402socks.com/v1/access/{package_id}` with `{}`. Expec","category":"network","line_end":70,"severity":"low","line_start":70},{"id":"network:SKILL.md:106:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"# https://eu-north1.x402socks.com:3129   token as username AND password","category":"network","line_end":106,"severity":"low","line_start":106},{"id":"network:SKILL.md:120:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Credential-bearing requests only ever go to `https://` endpoints. The helper rejects a plaintext `","category":"network","line_end":120,"severity":"low","line_start":120},{"id":"network:SKILL.md:124:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **Rotate** (you still hold the token): `POST https://api.x402socks.com/api/v1/token/rotate` with t","category":"network","line_end":124,"severity":"low","line_start":124},{"id":"network:SKILL.md:125:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- **Recover** (payment settled, token lost): `POST https://payments.x402socks.com/v1/access/recover`","category":"network","line_end":125,"severity":"low","line_start":125},{"id":"network:SKILL.md:136:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Support is a Telegram channel (`https://t.me/x402socks`), not a ticket queue.","category":"network","line_end":136,"severity":"low","line_start":136},{"id":"network:SKILL.md:3:socks-proxy","file":"SKILL.md","pattern":"SOCKS proxy","snippet":"description: Use this skill when an agent needs a different source IP, rotating or geo-specific egre","category":"network","line_end":3,"severity":"high","line_start":3},{"id":"network:SKILL.md:15:socks-proxy","file":"SKILL.md","pattern":"SOCKS proxy","snippet":"The default transport is **TLS HTTP CONNECT on port 3129**, available on `eu-north1`, `asia-central2","category":"network","line_end":15,"severity":"high","line_start":15},{"id":"network:SKILL.md:73:socks-proxy","file":"SKILL.md","pattern":"SOCKS proxy","snippet":"6. **Route traffic** through an exit. Default to TLS HTTP CONNECT on TCP 3129 using the token for bo","category":"network","line_end":73,"severity":"high","line_start":73},{"id":"network:SKILL.md:89:socks-proxy","file":"SKILL.md","pattern":"SOCKS proxy","snippet":"Every exit offers **SOCKS5 on TCP 1080** as the primary protocol. `eu-north1`, `asia-central2`, and ","category":"network","line_end":89,"severity":"high","line_start":89},{"id":"network:SKILL.md:91:socks-proxy","file":"SKILL.md","pattern":"SOCKS proxy","snippet":"| Exit ID         | Region                | SOCKS5 1080 | TLS 3129 |","category":"network","line_end":91,"severity":"high","line_start":91},{"id":"network:SKILL.md:108:socks-proxy","file":"SKILL.md","pattern":"SOCKS proxy","snippet":"# Legacy plaintext and SOCKS5 forms are opt-in only; see references/endpoints.md.","category":"network","line_end":108,"severity":"high","line_start":108},{"id":"network:SKILL.md:111:socks-proxy","file":"SKILL.md","pattern":"SOCKS proxy","snippet":"Client snippets for curl, Python, Node, Playwright, and Chrome are in `references/endpoints.md`. If ","category":"network","line_end":111,"severity":"high","line_start":111},{"id":"network:SKILL.md:118:socks-proxy","file":"SKILL.md","pattern":"SOCKS proxy","snippet":"- Prefer TLS CONNECT on port 3129. SOCKS5 and plaintext HTTP CONNECT authenticate with the token in ","category":"network","line_end":118,"severity":"high","line_start":118},{"id":"filesystem:SKILL.md:82:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"scripts/x402socks.sh save-token             # stdin -> ~/.config/x402socks/token (0600)","category":"filesystem","line_end":82,"severity":"high","line_start":82},{"id":"filesystem:SKILL.md:115:hidden-file-in-home-directory","file":"SKILL.md","pattern":"Hidden file in home directory","snippet":"- The token is a secret. Store it in a file with mode `0600` (`X402SOCKS_TOKEN_FILE`, default `~/.co","category":"filesystem","line_end":115,"severity":"high","line_start":115},{"id":"filesystem:SKILL.md:82:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"scripts/x402socks.sh save-token             # stdin -> ~/.config/x402socks/token (0600)","category":"filesystem","line_end":82,"severity":"medium","line_start":82},{"id":"filesystem:SKILL.md:115:hidden-file-access","file":"SKILL.md","pattern":"Hidden file access","snippet":"- The token is a secret. Store it in a file with mode `0600` (`X402SOCKS_TOKEN_FILE`, default `~/.co","category":"filesystem","line_end":115,"severity":"medium","line_start":115},{"id":"blocker:SKILL.md:3:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"description: Use this skill when an agent needs a different source IP, rotating or geo-specific egre","category":"blocker","line_end":3,"severity":"low","line_start":3},{"id":"blocker:SKILL.md:15:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"The default transport is **TLS HTTP CONNECT on port 3129**, available on `eu-north1`, `asia-central2","category":"blocker","line_end":15,"severity":"low","line_start":15},{"id":"blocker:SKILL.md:102:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Plaintext HTTP CONNECT on **3128** is supported only for browser compatibility (Chrome and similar) ","category":"blocker","line_end":102,"severity":"low","line_start":102},{"id":"blocker:SKILL.md:111:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Client snippets for curl, Python, Node, Playwright, and Chrome are in `references/endpoints.md`. If ","category":"blocker","line_end":111,"severity":"low","line_start":111},{"id":"obfuscation:multiple:1:heuristic-suspicious-combination-filesystem-cred","file":"multiple","pattern":"[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network","snippet":"This combination could indicate credential harvesting and exfiltration","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"network:README.md:5:socks-proxy","reason":"The passage describes the advertised proxy service with TLS CONNECT preferred and legacy transports explicitly optional. No covert proxying or unauthorized credential transfer is shown.","verdict":"false_positive","confidence":0.99},{"id":"network:README.md:59:socks-proxy","reason":"The passage describes the advertised proxy service with TLS CONNECT preferred and legacy transports explicitly optional. No covert proxying or unauthorized credential transfer is shown.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:README.md:32:hidden-file-in-home-directory","reason":"The example installs this skill into the client's normal user-owned skills directory. It does not access unrelated hidden credentials or establish covert persistence.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:README.md:33:hidden-file-in-home-directory","reason":"The example installs this skill into the client's normal user-owned skills directory. It does not access unrelated hidden credentials or establish covert persistence.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:README.md:52:hidden-file-in-home-directory","reason":"This path holds the service's intended proxy token, not unrelated user credentials. The documented writer uses mode 0600 and clients consume it for authentication.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:README.md:32:hidden-file-access","reason":"The example installs this skill into the client's normal user-owned skills directory. It does not access unrelated hidden credentials or establish covert persistence.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:README.md:33:hidden-file-access","reason":"The example installs this skill into the client's normal user-owned skills directory. It does not access unrelated hidden credentials or establish covert persistence.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:README.md:52:hidden-file-access","reason":"This path holds the service's intended proxy token, not unrelated user credentials. The documented writer uses mode 0600 and clients consume it for authentication.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/endpoints.md:207:ruby-shell-backtick-execution","reason":"These are JavaScript template literals for a local token path or Basic proxy authentication. JavaScript backticks do not execute shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/endpoints.md:211:ruby-shell-backtick-execution","reason":"These are JavaScript template literals for a local token path or Basic proxy authentication. JavaScript backticks do not execute shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/endpoints.md:231:ruby-shell-backtick-execution","reason":"These are JavaScript template literals for a local token path or Basic proxy authentication. JavaScript backticks do not execute shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/endpoints.md:106:shell-command-substitution","reason":"The substitution captures a mktemp filename under umask 077, with an EXIT cleanup trap. No external input becomes shell code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/endpoints.md:170:shell-command-substitution","reason":"The substitution captures a mktemp filename under umask 077, with an EXIT cleanup trap. No external input becomes shell code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/endpoints.md:174:shell-command-substitution","reason":"Quoted cat substitutions read the intended proxy token into a private curl configuration file. The token is not executed or passed in argv.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:194:http-https-request","reason":"This deliberate HTTPS ipify request verifies the proxy egress IP. Authentication is directed to the TLS proxy, not included in destination application data.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:194:http-client-library","reason":"This deliberate HTTPS ipify request verifies the proxy egress IP. Authentication is directed to the TLS proxy, not included in destination application data.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:214:http-client-library","reason":"This deliberate HTTPS ipify request verifies the proxy egress IP. Authentication is directed to the TLS proxy, not included in destination application data.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:22:hardcoded-url","reason":"This URL identifies the documented TLS CONNECT proxy listener. It uses HTTPS and does not embed credentials in the address.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:53:hardcoded-url","reason":"The URL is an illustrative proxy node hostname in a discovery response. It neither executes a request nor collects local system information.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:109:hardcoded-url","reason":"This HTTPS request sends the intended token to the documented status endpoint. Its JSON body is read from a private temporary file.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:172:hardcoded-url","reason":"This URL identifies the documented TLS CONNECT proxy listener. It uses HTTPS and does not embed credentials in the address.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:176:hardcoded-url","reason":"This deliberate HTTPS ipify request verifies the proxy egress IP. Authentication is directed to the TLS proxy, not included in destination application data.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:191:hardcoded-url","reason":"This URL identifies the documented TLS CONNECT proxy listener. It uses HTTPS and does not embed credentials in the address.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:194:hardcoded-url","reason":"This deliberate HTTPS ipify request verifies the proxy egress IP. Authentication is directed to the TLS proxy, not included in destination application data.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:210:hardcoded-url","reason":"This URL identifies the documented TLS CONNECT proxy listener. It uses HTTPS and does not embed credentials in the address.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:214:hardcoded-url","reason":"This deliberate HTTPS ipify request verifies the proxy egress IP. Authentication is directed to the TLS proxy, not included in destination application data.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:235:hardcoded-url","reason":"This URL identifies the documented TLS CONNECT proxy listener. It uses HTTPS and does not embed credentials in the address.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:245:hardcoded-url","reason":"This URL identifies the documented TLS CONNECT proxy listener. It uses HTTPS and does not embed credentials in the address.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:27:socks-proxy","reason":"This reference documents the intended proxy protocol and its legacy transport restrictions. Executable cleartext token transmission is assessed separately in the helper.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:34:socks-proxy","reason":"This reference documents the intended proxy protocol and its legacy transport restrictions. Executable cleartext token transmission is assessed separately in the helper.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:218:socks-proxy","reason":"This client compatibility explanation or example selects TLS HTTP CONNECT instead of SOCKS5. It does not establish an unencrypted authenticated SOCKS connection.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:222:socks-proxy","reason":"This client compatibility explanation or example selects TLS HTTP CONNECT instead of SOCKS5. It does not establish an unencrypted authenticated SOCKS connection.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:224:socks-proxy","reason":"This client compatibility explanation or example selects TLS HTTP CONNECT instead of SOCKS5. It does not establish an unencrypted authenticated SOCKS connection.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:235:socks-proxy","reason":"This client compatibility explanation or example selects TLS HTTP CONNECT instead of SOCKS5. It does not establish an unencrypted authenticated SOCKS connection.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:253:socks-proxy","reason":"This reference documents the intended proxy protocol and its legacy transport restrictions. Executable cleartext token transmission is assessed separately in the helper.","verdict":"false_positive","confidence":0.99},{"id":"network:references/endpoints.md:261:socks-proxy","reason":"This reference documents the intended proxy protocol and its legacy transport restrictions. Executable cleartext token transmission is assessed separately in the helper.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/endpoints.md:203:synchronous-file-operations","reason":"The Node example imports or reads the intended local proxy token once during client setup. Synchronous access here is not credential harvesting.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/endpoints.md:207:synchronous-file-operations","reason":"The Node example imports or reads the intended local proxy token once during client setup. Synchronous access here is not credential harvesting.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/endpoints.md:228:synchronous-file-operations","reason":"The Node example imports or reads the intended local proxy token once during client setup. Synchronous access here is not credential harvesting.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/endpoints.md:231:synchronous-file-operations","reason":"The Node example imports or reads the intended local proxy token once during client setup. Synchronous access here is not credential harvesting.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/endpoints.md:174:hidden-file-in-home-directory","reason":"This path holds the service's intended proxy token, not unrelated user credentials. The documented writer uses mode 0600 and clients consume it for authentication.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/endpoints.md:187:hidden-file-in-home-directory","reason":"This path holds the service's intended proxy token, not unrelated user credentials. The documented writer uses mode 0600 and clients consume it for authentication.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/endpoints.md:10:hidden-file-access","reason":"The .well-known path is an HTTPS discovery resource, not a hidden local file. No home-directory or filesystem access occurs.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/endpoints.md:15:hidden-file-access","reason":"The .well-known path is an HTTPS discovery resource, not a hidden local file. No home-directory or filesystem access occurs.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/endpoints.md:108:hidden-file-access","reason":"This path holds the service's intended proxy token, not unrelated user credentials. The documented writer uses mode 0600 and clients consume it for authentication.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/endpoints.md:174:hidden-file-access","reason":"This path holds the service's intended proxy token, not unrelated user credentials. The documented writer uses mode 0600 and clients consume it for authentication.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/endpoints.md:187:hidden-file-access","reason":"This path holds the service's intended proxy token, not unrelated user credentials. The documented writer uses mode 0600 and clients consume it for authentication.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/endpoints.md:207:hidden-file-access","reason":"This path holds the service's intended proxy token, not unrelated user credentials. The documented writer uses mode 0600 and clients consume it for authentication.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/endpoints.md:231:hidden-file-access","reason":"This path holds the service's intended proxy token, not unrelated user credentials. The documented writer uses mode 0600 and clients consume it for authentication.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/endpoints.md:106:temp-file-creation","reason":"The example creates a temporary credential payload under umask 077 and removes it with an EXIT trap. It does not create a world-readable secret.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/endpoints.md:170:temp-file-creation","reason":"The example creates a temporary credential payload under umask 077 and removes it with an EXIT trap. It does not create a world-readable secret.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/endpoints.md:53:system-reconnaissance","reason":"This hostname belongs to an illustrative public node response. It does not enumerate the local host.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/endpoints.md:133:system-reconnaissance","reason":"This text explains the documented token rotation response and invalidation behavior. It performs no system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/payments.md:106:ruby-shell-backtick-execution","reason":"These backticks occur inside an error message or JavaScript template literal. Neither constructs a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/payments.md:145:ruby-shell-backtick-execution","reason":"The backticks define a TypeScript hexadecimal string type, not a shell command. The private key is used locally for payment signing.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/payments.md:163:ruby-shell-backtick-execution","reason":"These backticks occur inside an error message or JavaScript template literal. Neither constructs a shell command.","verdict":"false_positive","confidence":0.99},{"id":"network:references/payments.md:8:hardcoded-url","reason":"This documented HTTPS payment endpoint requests proxy access or illustrates the challenge resource. No unrelated destination or private-key transmission is shown.","verdict":"false_positive","confidence":0.99},{"id":"network:references/payments.md:25:hardcoded-url","reason":"This documented HTTPS payment endpoint requests proxy access or illustrates the challenge resource. No unrelated destination or private-key transmission is shown.","verdict":"false_positive","confidence":0.99},{"id":"network:references/payments.md:159:hardcoded-url","reason":"The request targets the advertised HTTPS purchase endpoint after approved payment terms are pinned. The wallet key remains in the local signer.","verdict":"false_positive","confidence":0.99},{"id":"network:references/payments.md:209:hardcoded-url","reason":"This documented HTTPS payment endpoint requests proxy access or illustrates the challenge resource. No unrelated destination or private-key transmission is shown.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/payments.md:270:hidden-file-in-home-directory","reason":"The example reads an explicitly prepared recovery signature from a private service-specific file. It passes the proof on stdin rather than exposing it through argv.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/payments.md:270:hidden-file-access","reason":"The example reads an explicitly prepared recovery signature from a private service-specific file. It passes the proof on stdin rather than exposing it through argv.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/payments.md:90:environment-variable-access-dot-notation","reason":"These environment values specify approved payment terms, not harvested secrets. They constrain signing; the code does not open an environment file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/payments.md:91:environment-variable-access-dot-notation","reason":"These environment values specify approved payment terms, not harvested secrets. They constrain signing; the code does not open an environment file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/payments.md:92:environment-variable-access-dot-notation","reason":"These environment values specify approved payment terms, not harvested secrets. They constrain signing; the code does not open an environment file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/payments.md:93:environment-variable-access-dot-notation","reason":"These environment values specify approved payment terms, not harvested secrets. They constrain signing; the code does not open an environment file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/payments.md:94:environment-variable-access-dot-notation","reason":"These environment values specify approved payment terms, not harvested secrets. They constrain signing; the code does not open an environment file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/payments.md:95:environment-variable-access-dot-notation","reason":"These environment values specify approved payment terms, not harvested secrets. They constrain signing; the code does not open an environment file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/payments.md:145:environment-variable-access-dot-notation","reason":"The explicitly configured wallet key creates a local viem signer for approved payment terms. No .env file read or raw-key network transmission is shown.","verdict":"false_positive","confidence":0.97},{"id":"env_access:references/payments.md:90:environment-variable-object","reason":"These environment values specify approved payment terms, not harvested secrets. They constrain signing; the code does not open an environment file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/payments.md:91:environment-variable-object","reason":"These environment values specify approved payment terms, not harvested secrets. They constrain signing; the code does not open an environment file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/payments.md:92:environment-variable-object","reason":"These environment values specify approved payment terms, not harvested secrets. They constrain signing; the code does not open an environment file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/payments.md:93:environment-variable-object","reason":"These environment values specify approved payment terms, not harvested secrets. They constrain signing; the code does not open an environment file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/payments.md:94:environment-variable-object","reason":"These environment values specify approved payment terms, not harvested secrets. They constrain signing; the code does not open an environment file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/payments.md:95:environment-variable-object","reason":"These environment values specify approved payment terms, not harvested secrets. They constrain signing; the code does not open an environment file.","verdict":"false_positive","confidence":0.99},{"id":"env_access:references/payments.md:145:environment-variable-object","reason":"The explicitly configured wallet key creates a local viem signer for approved payment terms. No .env file read or raw-key network transmission is shown.","verdict":"false_positive","confidence":0.97},{"id":"env_access:references/payments.md:145:generic-api-secret-keys","reason":"The explicitly configured wallet key creates a local viem signer for approved payment terms. No .env file read or raw-key network transmission is shown.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/payments.md:90:environment-file-access","reason":"These environment values specify approved payment terms, not harvested secrets. They constrain signing; the code does not open an environment file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/payments.md:91:environment-file-access","reason":"These environment values specify approved payment terms, not harvested secrets. They constrain signing; the code does not open an environment file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/payments.md:92:environment-file-access","reason":"These environment values specify approved payment terms, not harvested secrets. They constrain signing; the code does not open an environment file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/payments.md:93:environment-file-access","reason":"These environment values specify approved payment terms, not harvested secrets. They constrain signing; the code does not open an environment file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/payments.md:94:environment-file-access","reason":"These environment values specify approved payment terms, not harvested secrets. They constrain signing; the code does not open an environment file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/payments.md:95:environment-file-access","reason":"These environment values specify approved payment terms, not harvested secrets. They constrain signing; the code does not open an environment file.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/payments.md:145:environment-file-access","reason":"The explicitly configured wallet key creates a local viem signer for approved payment terms. No .env file read or raw-key network transmission is shown.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/payments.md:84:crypto-seed-private-key-mention","reason":"The viem privateKeyToAccount API creates a local signer for the requested USDC purchase. The example pins approved terms and never transmits the raw key.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/payments.md:144:crypto-seed-private-key-mention","reason":"The viem privateKeyToAccount API creates a local signer for the requested USDC purchase. The example pins approved terms and never transmits the raw key.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/payments.md:291:system-reconnaissance","reason":"This row documents a plan-expired recovery error. It does not access the host, enumerate processes, or scan networks.","verdict":"false_positive","confidence":0.99},{"id":"network:references/troubleshooting.md:14:socks-proxy","reason":"The guidance warns that legacy proxy transports expose credentials and require explicit opt-in. It does not silently enable an insecure fallback.","verdict":"false_positive","confidence":0.99},{"id":"network:references/troubleshooting.md:28:socks-proxy","reason":"This diagnostic row recommends validation, status checks, and recovery after authentication fails. It does not initiate a SOCKS connection or collect credentials.","verdict":"false_positive","confidence":0.99},{"id":"network:references/troubleshooting.md:39:socks-proxy","reason":"This row recommends remote DNS to avoid local hostname leakage. It is mitigation guidance, not reconnaissance or covert traffic routing.","verdict":"false_positive","confidence":0.99},{"id":"network:references/troubleshooting.md:40:socks-proxy","reason":"This row recommends verified TLS CONNECT for browser compatibility instead of authenticated SOCKS5. The plaintext alternative is explicitly identified as such.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/troubleshooting.md:22:system-reconnaissance","reason":"This diagnostic table describes proxy errors and corrective actions. It does not run host inventory commands or scan unrelated systems.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/troubleshooting.md:25:system-reconnaissance","reason":"This diagnostic table describes proxy errors and corrective actions. It does not run host inventory commands or scan unrelated systems.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/troubleshooting.md:34:system-reconnaissance","reason":"This diagnostic table describes proxy errors and corrective actions. It does not run host inventory commands or scan unrelated systems.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/troubleshooting.md:36:system-reconnaissance","reason":"This diagnostic table describes proxy errors and corrective actions. It does not run host inventory commands or scan unrelated systems.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:91:ruby-shell-backtick-execution","reason":"The backticks surround python3 -c in a shell comment. Comments are not executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:62:shell-command-substitution","reason":"The substitution reads curl configuration from stdin into a quoted variable. It does not evaluate the configuration as shell code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:70:shell-command-substitution","reason":"The substitution calls the local cfg_escape function on the URL. Its output becomes a curl configuration value, not shell code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:80:shell-command-substitution","reason":"The substitution resolves the operator-configured token filename. The returned path is quoted and is not executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:95:shell-command-substitution","reason":"The substitution resolves the destination token filename for the protected writer. It does not execute the returned path.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:96:shell-command-substitution","reason":"Quoted dirname output selects the token directory for mkdir. The path is not interpreted as a shell command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:255:shell-command-substitution","reason":"The substitution captures a payment challenge header from an unpaid POST. Quoted arguments prevent shell evaluation of the package identifier.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:260:shell-command-substitution","reason":"The substitution decodes the payment challenge using fixed Python code. The remote payload is parsed as JSON, not executed.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:312:shell-command-substitution","reason":"The substitution removes CR and LF from a token supplied on stdin. The token remains data, not shell code or argv.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:317:shell-command-substitution","reason":"The substitution serializes the token using json.dumps through stdin. No token is interpolated into executable Python code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:324:shell-command-substitution","reason":"The substitution reads the intended service token from its configured file or environment fallback. It is used as data for an HTTPS status request.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:325:shell-command-substitution","reason":"The substitution serializes the status token as JSON using a fixed local helper. The token is neither executed nor placed in argv.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:326:shell-command-substitution","reason":"The substitution builds escaped curl configuration containing the status request body. The configuration is delivered on stdin, not through secret-bearing arguments.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:333:shell-command-substitution","reason":"The substitution retrieves the intended token for the explicit validation command. It does not execute the token.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:334:shell-command-substitution","reason":"The substitution serializes the validation token using a JSON encoder. The secret is passed on stdin rather than as a process argument.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:335:shell-command-substitution","reason":"The substitution creates escaped curl configuration for token validation. The configuration is passed on stdin rather than evaluated by a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:336:shell-command-substitution","reason":"The substitution captures only the HTTP validation status code. The token-bearing request uses HTTPS and stdin configuration.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:349:shell-command-substitution","reason":"The substitution retrieves the intended token for an operator-requested rotation. It does not execute the token or expose it through argv.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:351:shell-command-substitution","reason":"The substitution builds an escaped Authorization header for the documented rotation endpoint. Curl receives the header on stdin, not in argv.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:422:shell-command-substitution","reason":"The substitution reads the intended proxy token before the egress test. The secret is used as data, not executable shell text.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:423:shell-command-substitution","reason":"The substitution serializes the token for pre-test validation with a JSON encoder. The fixed helper receives the secret on stdin.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:424:shell-command-substitution","reason":"The substitution constructs escaped curl configuration for the pre-test token check. It does not evaluate token contents as shell code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:425:shell-command-substitution","reason":"The substitution captures the validation HTTP code before testing egress. Its HTTPS request sends credentials through stdin configuration.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:428:shell-command-substitution","reason":"The substitution constructs escaped proxy settings for curl through stdin. It is not shell injection; legacy transport exposure is assessed separately.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/x402socks.sh:429:shell-command-substitution","reason":"These substitutions escape the proxy address and authentication values for curl configuration. They do not execute the credential values.","verdict":"false_positive","confidence":0.97},{"id":"external_commands:scripts/x402socks.sh:430:shell-command-substitution","reason":"The substitution captures the public egress IP from the deliberate ipify test. Proxy credentials are supplied as proxy authentication, not destination request data.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:440:shell-command-substitution","reason":"The substitution invokes date with the fixed +%s argument. It produces a recovery timestamp without executing user input.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:450:shell-command-substitution","reason":"The default substitution invokes date with fixed arguments when no timestamp was supplied. The transaction and timestamp remain quoted data.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:456:shell-command-substitution","reason":"The substitution constructs recovery JSON using fixed Python code and stdin data. The ownership signature is not placed in argv.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:scripts/x402socks.sh:463:shell-command-substitution","reason":"The substitution builds escaped curl configuration for the recovery request body. The signature travels through stdin to the HTTPS service.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/x402socks.sh:10:hardcoded-url","reason":"This is the documented HTTPS service origin for health, discovery, and token checks. No unrelated collection endpoint is introduced.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/x402socks.sh:11:hardcoded-url","reason":"This is the documented HTTPS payment and credential recovery origin. Requests serve the stated purchase and recovery workflows.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/x402socks.sh:12:hardcoded-url","reason":"This is the documented HTTPS token rotation origin. It is not a separate credential collection service.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/x402socks.sh:17:hardcoded-url","reason":"This comment states the HTTPS requirement for credential-bearing requests. It does not perform a network transfer.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/x402socks.sh:23:hardcoded-url","reason":"This scheme check permits HTTPS credential endpoints. It enforces transport security rather than leaking credentials.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/x402socks.sh:24:hardcoded-url","reason":"This branch permits HTTP only after an explicit insecure-API override intended for trusted local tests. Otherwise it aborts before reading credentials.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/x402socks.sh:64:hardcoded-url","reason":"These curl protocol restrictions limit credential-bearing HTTPS transfers and redirects to HTTPS. They prevent a silent plaintext downgrade.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/x402socks.sh:65:hardcoded-url","reason":"This protocol list supports the separately gated local-test HTTP override. It does not enable plaintext credential requests by default.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/x402socks.sh:408:hardcoded-url","reason":"The default proxy uses HTTPS on port 3129 with certificate verification. Exit identifiers are validated before the hostname is constructed.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/x402socks.sh:414:hardcoded-url","reason":"This branch selects an HTTP proxy that receives the reusable authentication token without encryption. Explicit opt-in limits activation but cannot prevent network interception.","verdict":"confirmed","severity":"high","confidence":0.99},{"id":"network:scripts/x402socks.sh:430:hardcoded-url","reason":"The HTTPS ipify request deliberately checks the public egress IP. The destination is not given the proxy token as application data.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/x402socks.sh:433:hardcoded-url","reason":"This printed command suggests comparing the direct public IP. It does not transmit a token or execute the suggested command.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/x402socks.sh:166:socks-proxy","reason":"This help text or comment describes optional legacy transports and warns about cleartext authentication. Actual token exposure is adjudicated on the executable branch.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/x402socks.sh:192:socks-proxy","reason":"This help text or comment describes optional legacy transports and warns about cleartext authentication. Actual token exposure is adjudicated on the executable branch.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/x402socks.sh:382:socks-proxy","reason":"This help text or comment describes optional legacy transports and warns about cleartext authentication. Actual token exposure is adjudicated on the executable branch.","verdict":"false_positive","confidence":0.99},{"id":"network:scripts/x402socks.sh:390:socks-proxy","reason":"The opt-in legacy branch sends the reusable proxy token without transport encryption. A network observer can capture it and consume paid access.","verdict":"confirmed","severity":"high","confidence":0.99},{"id":"network:scripts/x402socks.sh:410:socks-proxy","reason":"The opt-in legacy branch sends the reusable proxy token without transport encryption. A network observer can capture it and consume paid access.","verdict":"confirmed","severity":"high","confidence":0.99},{"id":"network:scripts/x402socks.sh:416:socks-proxy","reason":"The opt-in legacy branch sends the reusable proxy token without transport encryption. A network observer can capture it and consume paid access.","verdict":"confirmed","severity":"high","confidence":0.99},{"id":"filesystem:scripts/x402socks.sh:173:hidden-file-in-home-directory","reason":"This path holds the service's intended proxy token, not unrelated user credentials. The documented writer uses mode 0600 and clients consume it for authentication.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/x402socks.sh:48:hidden-file-access","reason":"This path holds the service's intended proxy token, not unrelated user credentials. The documented writer uses mode 0600 and clients consume it for authentication.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/x402socks.sh:173:hidden-file-access","reason":"This path holds the service's intended proxy token, not unrelated user credentials. The documented writer uses mode 0600 and clients consume it for authentication.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/x402socks.sh:35:standard-device-file-access","reason":"The /dev/null redirection discards routine output or HTTP bodies. It does not read device secrets or modify system devices.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/x402socks.sh:40:standard-device-file-access","reason":"The /dev/null redirection discards routine output or HTTP bodies. It does not read device secrets or modify system devices.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/x402socks.sh:41:standard-device-file-access","reason":"The /dev/null redirection discards routine output or HTTP bodies. It does not read device secrets or modify system devices.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/x402socks.sh:255:standard-device-file-access","reason":"The /dev/null redirection discards routine output or HTTP bodies. It does not read device secrets or modify system devices.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/x402socks.sh:337:standard-device-file-access","reason":"The /dev/null redirection discards routine output or HTTP bodies. It does not read device secrets or modify system devices.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/x402socks.sh:426:standard-device-file-access","reason":"The /dev/null redirection discards routine output or HTTP bodies. It does not read device secrets or modify system devices.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/x402socks.sh:98:temp-file-creation","reason":"The protected token writer uses mkstemp in the checked directory, producing mode 0600 before atomic replacement. Temporary files are cleaned on failure.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/x402socks.sh:132:temp-file-creation","reason":"The protected token writer uses mkstemp in the checked directory, producing mode 0600 before atomic replacement. Temporary files are cleaned on failure.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/x402socks.sh:134:python-file-write-append","reason":"The code writes the intended proxy token through a mode-0600 mkstemp descriptor, fsyncs it, and atomically replaces the token file.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/x402socks.sh:125:python-os-file-operations","reason":"The chmod narrows an owned token directory to mode 0700 after checking ownership and rejecting shared-write permissions. It strengthens local secret storage.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:scripts/x402socks.sh:143:python-os-file-operations","reason":"The unlink removes only the temporary file created by the token writer after a failure. It is scoped cleanup, not deletion of user data.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:scripts/x402socks.sh:267:python-base64-decode","reason":"The decoder parses the x402 payment challenge header into JSON to display and check its terms. Decoded content is not executed.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/x402socks.sh:115:certificate-key-files","reason":"The matched data.keys() lists JSON response field names for a redacted error. It does not reference certificate or private-key files.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/x402socks.sh:107:system-reconnaissance","reason":"This fixed parser error reports malformed JSON without echoing the response. It does not inspect the host or enumerate system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/x402socks.sh:114:system-reconnaissance","reason":"This error lists response field names rather than secret values. It does not enumerate local accounts, files, or processes.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/x402socks.sh:122:system-reconnaissance","reason":"This ownership and permission check protects the intended token directory. Reading the current UID for access checks is not hostile system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/x402socks.sh:214:system-reconnaissance","reason":"The code displays the public proxy service's node inventory. It does not inspect the user's machine or scan arbitrary hosts.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/x402socks.sh:342:system-reconnaissance","reason":"This message reports token validation's HTTP status. It is ordinary error handling, not host reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/x402socks.sh:356:system-reconnaissance","reason":"The comment describes exit identifier validation and public feed checks. It is not executable discovery or a system inventory command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/x402socks.sh:366:system-reconnaissance","reason":"The code rejects malformed exit identifiers before constructing a proxy hostname. This is input validation, not host enumeration.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/x402socks.sh:377:system-reconnaissance","reason":"This error rejects an exit absent from the service's public node feed. It does not probe local or unrelated systems.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/x402socks.sh:394:system-reconnaissance","reason":"The argument check rejects multiple exit identifiers. It neither inventories the environment nor initiates network scanning.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/x402socks.sh:404:system-reconnaissance","reason":"This call validates the selected exit against the service's advertised node feed. It does not scan arbitrary hosts.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/x402socks.sh:427:system-reconnaissance","reason":"The check stops the egress test when token validation fails. It does not gather local system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/x402socks.sh:431:system-reconnaissance","reason":"This fixed message reports an egress request failure. It does not invoke reconnaissance commands.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/x402socks.sh:443:system-reconnaissance","reason":"The message prints a public recovery timestamp and validity window. It does not collect host details or secrets.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:55:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:56:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:59:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:96:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:98:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:104:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:115:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:116:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:140:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","reason":"These backticks delimit Markdown code spans or fenced examples, not executable shell substitutions. The cited prose does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:8:hardcoded-url","reason":"The URL is the skill's declared service homepage. Merely declaring the homepage does not transmit credentials.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:21:hardcoded-url","reason":"The HTTPS request checks public service health without credentials. This is a documented prerequisite to purchasing access.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:22:hardcoded-url","reason":"The HTTPS request reads public proxy node availability without credentials. It supports the intended exit selection workflow.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:70:hardcoded-url","reason":"This is the documented HTTPS endpoint for requesting an unpaid access challenge. Payment requires separate explicit authorization and signature validation.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:106:hardcoded-url","reason":"This example identifies a TLS CONNECT listener without embedding a token. Certificate verification protects authentication on the client-to-proxy hop.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:120:hardcoded-url","reason":"This rule requires HTTPS for credential-bearing endpoints and rejects plaintext overrides by default. It is protective guidance, not exfiltration.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:124:hardcoded-url","reason":"The HTTPS rotation endpoint is part of the stated credential lifecycle. The instruction requires stdin or private-file authentication and redacted output.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:125:hardcoded-url","reason":"The HTTPS recovery endpoint receives a wallet ownership proof for restoring purchased access. It does not request disclosure of the wallet private key.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:136:hardcoded-url","reason":"This is a disclosed support channel, not an automatic network request. Troubleshooting guidance explicitly prohibits sharing live tokens.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:3:socks-proxy","reason":"The passage describes the advertised proxy service with TLS CONNECT preferred and legacy transports explicitly optional. No covert proxying or unauthorized credential transfer is shown.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:15:socks-proxy","reason":"The passage describes the advertised proxy service with TLS CONNECT preferred and legacy transports explicitly optional. No covert proxying or unauthorized credential transfer is shown.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:73:socks-proxy","reason":"The passage describes the advertised proxy service with TLS CONNECT preferred and legacy transports explicitly optional. No covert proxying or unauthorized credential transfer is shown.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:89:socks-proxy","reason":"The passage describes the advertised proxy service with TLS CONNECT preferred and legacy transports explicitly optional. No covert proxying or unauthorized credential transfer is shown.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:91:socks-proxy","reason":"The passage describes the advertised proxy service with TLS CONNECT preferred and legacy transports explicitly optional. No covert proxying or unauthorized credential transfer is shown.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:108:socks-proxy","reason":"The passage describes the advertised proxy service with TLS CONNECT preferred and legacy transports explicitly optional. No covert proxying or unauthorized credential transfer is shown.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:111:socks-proxy","reason":"The passage describes the advertised proxy service with TLS CONNECT preferred and legacy transports explicitly optional. No covert proxying or unauthorized credential transfer is shown.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:118:socks-proxy","reason":"The passage describes the advertised proxy service with TLS CONNECT preferred and legacy transports explicitly optional. No covert proxying or unauthorized credential transfer is shown.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:82:hidden-file-in-home-directory","reason":"This path holds the service's intended proxy token, not unrelated user credentials. The documented writer uses mode 0600 and clients consume it for authentication.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:115:hidden-file-in-home-directory","reason":"This path holds the service's intended proxy token, not unrelated user credentials. The documented writer uses mode 0600 and clients consume it for authentication.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:82:hidden-file-access","reason":"This path holds the service's intended proxy token, not unrelated user credentials. The documented writer uses mode 0600 and clients consume it for authentication.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:115:hidden-file-access","reason":"This path holds the service's intended proxy token, not unrelated user credentials. The documented writer uses mode 0600 and clients consume it for authentication.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:3:system-reconnaissance","reason":"This prose describes proxy selection, transport security, or DNS behavior for the advertised service. It contains no local system enumeration or network scanning.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:15:system-reconnaissance","reason":"This prose describes proxy selection, transport security, or DNS behavior for the advertised service. It contains no local system enumeration or network scanning.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:102:system-reconnaissance","reason":"This prose describes proxy selection, transport security, or DNS behavior for the advertised service. It contains no local system enumeration or network scanning.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:111:system-reconnaissance","reason":"This prose describes proxy selection, transport security, or DNS behavior for the advertised service. It contains no local system enumeration or network scanning.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:multiple:1:heuristic-suspicious-combination-filesystem-cred","reason":"Filesystem, credentials, and networking implement the advertised paid proxy workflow with protected token storage and a local wallet signer. No unrelated credential harvesting was found.","verdict":"false_positive","confidence":0.97}],"semantic_findings":[{"title":"Rotation Invalidates Access Before Local Storage Is Validated","severity":"medium","locations":[{"file":"scripts/x402socks.sh","line_end":352,"line_start":346},{"file":"scripts/x402socks.sh","line_end":127,"line_start":96},{"file":"scripts/x402socks.sh","line_end":150,"line_start":129}],"confidence":0.98,"description":"Rotation invalidates the old token before the writer checks directory ownership, permissions, symlinks, or writability. A storage failure discards the one-time replacement and interrupts paid access until wallet-based recovery.","confidence_reasoning":"The remote rotation request precedes all writer checks, and the documented API immediately invalidates the old token. Writer errors exit without preserving the replacement."}],"subject_marketplace_commit_sha":"9938f91a9ab0f5763a54332b129295339bf829dd","subject_content_hash":"ced61fec573263b6f1d5775c4ab05005ca68f1e4b5b1b29a885d5d38b47f997f","subject_tree_hash":"df16939866aea38d963a9cab8979f6e442536fde8f9390072a50fd1412d2ad9e","subject_plugin_path":"skills/x402socks/x402socks","audit_payload_hash":"cb2ac9a881770d71134173d43f1ef08d","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"9938f91a9ab0f5763a54332b129295339bf829dd","contentHash":"ced61fec573263b6f1d5775c4ab05005ca68f1e4b5b1b29a885d5d38b47f997f","treeHash":"df16939866aea38d963a9cab8979f6e442536fde8f9390072a50fd1412d2ad9e","pluginPath":"skills/x402socks/x402socks","auditPayloadHash":"cb2ac9a881770d71134173d43f1ef08d"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/x402socks-x402socks/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":4,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}