📦

x402socks

Name: x402socks
Author: x402socks

v1.2.4 Inhaltsrevision r5 Mittleres Risiko 🌐 Netzwerkzugriff📁 Dateisystemzugriff⚙️ Externe Befehle🔑 Umgebungsvariablen

Manage Paid Proxy Access with x402socks

Agents may need regional proxy egress without a subscription account. This skill guides approved USDC purchases, token management, and verified TLS CONNECT routing through x402socks.

Unterstützt: Claude Codex Code(CC)

🥈 82 Silber

Maintain this Skill? Claim it 🥈 82 Silber

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "x402socks" from https://skillstore.io/skills/x402socks-x402socks.md and its manifest at https://skillstore.io/api/skills/x402socks-x402socks/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/x402socks-x402socks.md Signiertes manifest GET /api/skills/x402socks-x402socks/manifest Signiertes lockfile GET /api/skills/x402socks-x402socks/lockfile

Testen

„x402socks“ wird verwendet. Show the live quote and stop before paying.

Erwartetes Ergebnis:

Illustrative result: the time_6h challenge requests 1 USDC on Base.
The amount is within the approved 1 USDC quote cap.
Review the displayed asset, recipient, and signing domain before approving a purchase.
No payment was signed or submitted.

„x402socks“ wird verwendet. Summarize an existing token validation and TLS egress check.

Erwartetes Ergebnis:

Illustrative result: the configured token is valid.
Selected exit: eu-north1. Transport: certificate-verified TLS CONNECT on port 3129.
Proxy egress IP: 203.0.113.42, an illustrative address rather than a live measurement.
No token or wallet secret is included.

„x402socks“ wird verwendet. A purchase settled but provisioning failed. What should happen next?

Erwartetes Ergebnis:

Do not submit another purchase for the same access.
Retain the settlement transaction hash and prepare a fresh recovery message.
Use the paying wallet to sign the ownership proof, then submit recovery without exposing the signature in command arguments.

Sicherheitsaudit

Mittleres Risiko

v5 • 8.11.2026 Versionsbericht öffnen

Most flags describe intended proxy operations, Markdown, or protected credential handling; no evidence found of credential harvesting or prompt injection. The opt-in legacy transport branch exposes reusable tokens without encryption. Rotation also invalidates the old token before local storage checks, risking loss of paid access.

Gescannte Dateien

1,367

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (1)

Mittel

scripts/x402socks.sh:346-352 scripts/x402socks.sh:96-127 scripts/x402socks.sh:129-150

Rotation Invalidates Access Before Local Storage Is Validated

Rotation invalidates the old token before the writer checks directory ownership, permissions, symlinks, or writability. A storage failure discards the one-time replacement and interrupts paid access until wallet-based recovery.

The remote rotation request precedes all writer checks, and the documented API immediately invalidates the old token. Writer errors exit without preserving the replacement.

Elemente der Fähigkeitsprüfung (4)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

scripts/x402socks.sh:414

Hardcoded URL

proxy="http://$exit_id.x402socks.com:3128"

This branch selects an HTTP proxy that receives the reusable authentication token without encryption. Explicit opt-in limits activation but cannot prevent network interception.

Hoch

scripts/x402socks.sh:390

SOCKS proxy

--socks5) mode="socks5" ;;

The opt-in legacy branch sends the reusable proxy token without transport encryption. A network observer can capture it and consume paid access.

Hoch

scripts/x402socks.sh:410

SOCKS proxy

plaintext|socks5)

The opt-in legacy branch sends the reusable proxy token without transport encryption. A network observer can capture it and consume paid access.

Hoch

scripts/x402socks.sh:416

SOCKS proxy

proxy="socks5h://$exit_id.x402socks.com:1080"

The opt-in legacy branch sends the reusable proxy token without transport encryption. A network observer can capture it and consume paid access.

Risikofaktoren

🌐 Netzwerkzugriff (50)

📁 Dateisystemzugriff (41)

⚙️ Externe Befehle (50)

🔑 Umgebungsvariablen (15)

references/payments.md:90 references/payments.md:91 references/payments.md:92 references/payments.md:93 references/payments.md:94 references/payments.md:95 references/payments.md:145 references/payments.md:90 references/payments.md:91 references/payments.md:92 references/payments.md:93 references/payments.md:94 references/payments.md:95 references/payments.md:145 references/payments.md:145

Geprüft von: codex Audit-Verlauf anzeigen →

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/x402socks-x402socks/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/x402socks-x402socks/security.svg)](https://skillstore.io/skills/x402socks-x402socks?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/x402socks-x402socks?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/x402socks-x402socks/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/x402socks-x402socks.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

x402socks. (2026). x402socks security audit report (audit version 5) [Author version 1.2.4]. Skillstore. https://skillstore.io/skills/x402socks-x402socks/audits/5

BibTeX-Zitat

@techreport{x402socks-x402socks-x402socks-2026,
  author = {x402socks},
  title = {x402socks security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/x402socks-x402socks/audits/5},
  note = {Author version 1.2.4}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "x402socks security audit report (audit version 5)"
version: "1.2.4"
type: report
authors:
  - name: "x402socks"
date-released: "2026-11-08"
url: "https://skillstore.io/skills/x402socks-x402socks/audits/5"
identifiers:
  - type: other
    value: "skillstore:x402socks-x402socks:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

100

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Verify Regional Application Behavior

Choose an available regional exit and confirm egress before testing location-dependent responses from an application you control.

Diagnose Proxy Connectivity

Check service health, node availability, token validity, and egress in sequence before replacing credentials or buying access again.

Control Agent Network Spending

Record approved payment terms, enforce signing limits, and choose a package that matches an authorized automation task.

Diese Prompts ausprobieren

Inspect Availability

Check x402socks health and list healthy TLS CONNECT exits. Do not purchase access or request wallet secrets.

Prepare a Purchase Quote

Quote time_6h with a maximum of 1 USDC. Show payment terms and entitlements, then wait for my approval before signing.

Test Existing Access

Use my configured token file to validate access and test eu-north1 with TLS CONNECT. Report the egress IP without revealing credentials.

Review Payment Integration

Review my TypeScript x402 integration against approved payment terms. Require signing-time checks and reject unexpected recipients, assets, domains, networks, or amounts.

Bewährte Praktiken

Approve the full payment terms and enforce them against the actual signing challenge, not only an earlier catalog quote.
Use certificate-verified TLS CONNECT and private token files; keep secrets out of arguments, logs, and chat transcripts.
Check live node health and token validity before retrying; recover settled purchases instead of paying twice.

Vermeiden

Letting a payment wrapper sign arbitrary challenges or treating a package name as unlimited spending approval.
Enabling plaintext proxy authentication on untrusted networks or disabling certificate verification.
Assuming cached prices, exit lists, or single-session packages support unlimited parallel automation.