Skills x402-erc7710

📦

x402-erc7710

Name: x402-erc7710
Author: internet-court

Content revision r1 High Risk ⚙️ External commands

Build x402 ERC-7710 Payment Demos

Paid agent demos are hard to design without unsafe wallet authority or unclear receipt handling. This skill gives Codex, Claude, and Claude Code structured patterns for bounded x402 payments and delegated spend.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "x402-erc7710" from https://skillstore.io/skills/internet-court-x402-erc7710.md and its manifest at https://skillstore.io/api/skills/internet-court-x402-erc7710/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/internet-court-x402-erc7710.md Signed manifest GET /api/skills/internet-court-x402-erc7710/manifest Signed lockfile GET /api/skills/internet-court-x402-erc7710/lockfile

Test it

Using "x402-erc7710". Inspect a paid evidence report endpoint before spending.

Expected outcome:

The response lists endpoint, token, amount, payee, route, and asset transfer method. It also states that no paid request was made.

Using "x402-erc7710". Plan a weekly agent research pass on Base Sepolia.

Expected outcome:

The response proposes tiny testnet caps, one provider wallet, one route allowlist, seven-day expiry, receipt storage, and dispute handling.

Using "x402-erc7710". Add GenLayer review to a delegated payment demo.

Expected outcome:

The response defines spend snapshots, review cadence, decision labels, bridge path, and the controller action for constrain or revoke decisions.

Security Audit

High Risk

v2 • 7/21/2026 Open versioned report

Most static alerts are false positives caused by Markdown backticks and payment-discovery language in documentation. Two confirmed high-severity findings describe exporting an agent private key in a JSON package, which can expose a bearer capability and permit unauthorized delegated spending. No prompt-injection language, data-exfiltration intent, or unscoped command execution was found.

Files scanned

291

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:119

Crypto seed/private key mention

- The page generates a real agent EOA for the demo and exports a JSON package containing the agent p

The skill directs the demo to generate a real agent EOA and export its private key in a JSON package. Exported private keys are bearer secrets and can enable unauthorized spending if exposed.

High

SKILL.md:147

Crypto seed/private key mention

- include private key in exported JSON or omit it;

The implementation menu presents including a private key in exported JSON as an option. This normalizes an insecure secret-export path that can expose the delegated wallet capability.

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/internet-court-x402-erc7710/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/internet-court-x402-erc7710/security.svg)](https://skillstore.io/skills/internet-court-x402-erc7710?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/internet-court-x402-erc7710?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-x402-erc7710/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/internet-court-x402-erc7710.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

internet-court. (2026). x402-erc7710 security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/internet-court-x402-erc7710/audits/2

BibTeX citation

@techreport{internet-court-internet-court-x402-erc7710-2026,
  author = {internet-court},
  title = {x402-erc7710 security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/internet-court-x402-erc7710/audits/2},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "x402-erc7710 security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
  - name: "internet-court"
date-released: "2026-07-21"
url: "https://skillstore.io/skills/internet-court-x402-erc7710/audits/2"
identifiers:
  - type: other
    value: "skillstore:internet-court-x402-erc7710:audit:2"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Prototype paid research APIs

Design a testnet agent that buys evidence reports through x402 within a weekly delegated budget.

Plan guarded agent subscriptions

Separate recurring policy from per-request x402 payments and define caps, expiry, and revocation paths.

Review payment demo safety

Check wallet approval, receipt evidence, route allowlists, and dispute handling before showing a demo.

Try These Prompts

Inspect a paid endpoint

Inspect this x402-protected endpoint. Identify the route, token, network, price, payee, and asset transfer method. Do not make a paid request.

Draft a bounded payment policy

Draft a bounded ERC-7710 payment policy for this x402 service. Include per-request cap, weekly cap, expiry, merchant, route, and revocation behavior.

Build a browser lab flow

Design a browser lab flow for Base Sepolia. Include wallet approval, delegated permission storage, x402 validation, receipt storage, and user warnings.

Design adjudicated revocation

Design an adjudicated x402 payment demo with signed intent, service receipt, spend snapshots, review decisions, and EVM-side revocation or constraint enforcement.

Best Practices

Start in discovery mode and ask before setting up payment authority.
Keep demo budgets tiny, time-limited, revocable, and tied to one merchant.
Validate receipts, settlement state, and signed evidence before review or dispute steps.

Avoid

Do not create unlimited approvals or open-ended agent wallets.
Do not treat x402 as a subscription state machine.
Do not export production private keys or ask users to share private keys.

Frequently Asked Questions

Can this skill make paid requests automatically?

No. It directs the agent to inspect requirements first and ask before creating delegated payment authority.

Does it implement x402 or ERC-7710 contracts?

No. It provides demo architecture, policy fields, workflow steps, and safety checks for implementation.

Which wallets does it target?

It discusses ERC-7715 wallet permission requests and MetaMask-style approval flows when supported by the target wallet.

Should demos use mainnet funds?

Use testnets by default. Mainnet use needs explicit user confirmation, strict caps, and clear receipt validation.

How does it handle subscriptions?

It keeps x402 as per-request payment and places recurrence in the delegated spend policy and accounting layer.

What is the main security concern?

The demo guidance can export an agent private key. Treat that artifact as a secret bearer capability.

Developer Details

Author

internet-court

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/internet-court/internet-court-skill/tree/main/integrations/x402-erc7710

Ref

3f6e026a3363e0954ede7bef0cfe88d4475de137

Maintenance freshness

7/21/2026

Usage

1 downloads · 0 views

File structure

📁 references/

📄 demo-blueprints.md

📄 SKILL.md

x402-erc7710

Install with my Agent

Agent-readable resources

Test it

Security Audit

Confirmed security concerns (2)

Risk Factors

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Skillstore Score

What You Can Build

Prototype paid research APIs

Plan guarded agent subscriptions

Review payment demo safety

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details