📦

x402socks

Name: x402socks
Author: x402socks

v1.2.4 コンテンツリビジョン r5 中リスク 🌐 ネットワークアクセス📁 ファイルシステムへのアクセス⚙️ 外部コマンド🔑 環境変数

Manage Paid Proxy Access with x402socks

Agents may need regional proxy egress without a subscription account. This skill guides approved USDC purchases, token management, and verified TLS CONNECT routing through x402socks.

対応: Claude Codex Code(CC)

🥈 82 シルバー

Maintain this Skill? Claim it 🥈 82 シルバー

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "x402socks" from https://skillstore.io/skills/x402socks-x402socks.md and its manifest at https://skillstore.io/api/skills/x402socks-x402socks/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/x402socks-x402socks.md 署名済み manifest GET /api/skills/x402socks-x402socks/manifest 署名済み lockfile GET /api/skills/x402socks-x402socks/lockfile

テストする

「x402socks」を使用しています。 Show the live quote and stop before paying.

期待される結果:

Illustrative result: the time_6h challenge requests 1 USDC on Base.
The amount is within the approved 1 USDC quote cap.
Review the displayed asset, recipient, and signing domain before approving a purchase.
No payment was signed or submitted.

「x402socks」を使用しています。 Summarize an existing token validation and TLS egress check.

期待される結果:

Illustrative result: the configured token is valid.
Selected exit: eu-north1. Transport: certificate-verified TLS CONNECT on port 3129.
Proxy egress IP: 203.0.113.42, an illustrative address rather than a live measurement.
No token or wallet secret is included.

「x402socks」を使用しています。 A purchase settled but provisioning failed. What should happen next?

期待される結果:

Do not submit another purchase for the same access.
Retain the settlement transaction hash and prepare a fresh recovery message.
Use the paying wallet to sign the ownership proof, then submit recovery without exposing the signature in command arguments.

セキュリティ監査

中リスク

v5 • 2026/11/8 バージョン別レポートを開く

Most flags describe intended proxy operations, Markdown, or protected credential handling; no evidence found of credential harvesting or prompt injection. The opt-in legacy transport branch exposes reusable tokens without encryption. Rotation also invalidates the old token before local storage checks, risking loss of paid access.

スキャンされたファイル

1,367

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (1)

中

scripts/x402socks.sh:346-352 scripts/x402socks.sh:96-127 scripts/x402socks.sh:129-150

Rotation Invalidates Access Before Local Storage Is Validated

Rotation invalidates the old token before the writer checks directory ownership, permissions, symlinks, or writability. A storage failure discards the one-time replacement and interrupts paid access until wallet-based recovery.

The remote rotation request precedes all writer checks, and the documented API immediately invalidates the old token. Writer errors exit without preserving the replacement.

機能レビュー項目 (4)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

高

scripts/x402socks.sh:414

Hardcoded URL

proxy="http://$exit_id.x402socks.com:3128"

This branch selects an HTTP proxy that receives the reusable authentication token without encryption. Explicit opt-in limits activation but cannot prevent network interception.

高

scripts/x402socks.sh:390

SOCKS proxy

--socks5) mode="socks5" ;;

The opt-in legacy branch sends the reusable proxy token without transport encryption. A network observer can capture it and consume paid access.

高

scripts/x402socks.sh:410

SOCKS proxy

plaintext|socks5)

The opt-in legacy branch sends the reusable proxy token without transport encryption. A network observer can capture it and consume paid access.

高

scripts/x402socks.sh:416

SOCKS proxy

proxy="socks5h://$exit_id.x402socks.com:1080"

The opt-in legacy branch sends the reusable proxy token without transport encryption. A network observer can capture it and consume paid access.

リスク要因

🌐 ネットワークアクセス (50)

📁 ファイルシステムへのアクセス (41)

⚙️ 外部コマンド (50)

🔑 環境変数 (15)

references/payments.md:90 references/payments.md:91 references/payments.md:92 references/payments.md:93 references/payments.md:94 references/payments.md:95 references/payments.md:145 references/payments.md:90 references/payments.md:91 references/payments.md:92 references/payments.md:93 references/payments.md:94 references/payments.md:95 references/payments.md:145 references/payments.md:145

監査者: codex 監査履歴を表示 →

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/x402socks-x402socks/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/x402socks-x402socks/security.svg)](https://skillstore.io/skills/x402socks-x402socks?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/x402socks-x402socks?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/x402socks-x402socks/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/x402socks-x402socks.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

x402socks. (2026). x402socks security audit report (audit version 5) [Author version 1.2.4]. Skillstore. https://skillstore.io/skills/x402socks-x402socks/audits/5

BibTeX形式の引用

@techreport{x402socks-x402socks-x402socks-2026,
  author = {x402socks},
  title = {x402socks security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/x402socks-x402socks/audits/5},
  note = {Author version 1.2.4}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "x402socks security audit report (audit version 5)"
version: "1.2.4"
type: report
authors:
  - name: "x402socks"
date-released: "2026-11-08"
url: "https://skillstore.io/skills/x402socks-x402socks/audits/5"
identifiers:
  - type: other
    value: "skillstore:x402socks-x402socks:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由証拠の信頼度: 中

アーキテクチャ

100

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Verify Regional Application Behavior

Choose an available regional exit and confirm egress before testing location-dependent responses from an application you control.

Diagnose Proxy Connectivity

Check service health, node availability, token validity, and egress in sequence before replacing credentials or buying access again.

Control Agent Network Spending

Record approved payment terms, enforce signing limits, and choose a package that matches an authorized automation task.

これらのプロンプトを試す

Inspect Availability

Check x402socks health and list healthy TLS CONNECT exits. Do not purchase access or request wallet secrets.

Prepare a Purchase Quote

Quote time_6h with a maximum of 1 USDC. Show payment terms and entitlements, then wait for my approval before signing.

Test Existing Access

Use my configured token file to validate access and test eu-north1 with TLS CONNECT. Report the egress IP without revealing credentials.

Review Payment Integration

Review my TypeScript x402 integration against approved payment terms. Require signing-time checks and reject unexpected recipients, assets, domains, networks, or amounts.

ベストプラクティス

Approve the full payment terms and enforce them against the actual signing challenge, not only an earlier catalog quote.
Use certificate-verified TLS CONNECT and private token files; keep secrets out of arguments, logs, and chat transcripts.
Check live node health and token validity before retrying; recover settled purchases instead of paying twice.

回避

Letting a payment wrapper sign arbitrary challenges or treating a package name as unlimited spending approval.
Enabling plaintext proxy authentication on untrusted networks or disabling certificate verification.
Assuming cached prices, exit lists, or single-session packages support unlimited parallel automation.