📦
Audit History
x402 Payments skill - 2 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 2 Latest
Jul 20, 2026, 03:34 AM
All 19 static findings are false positives caused by Markdown backticks, not shell execution. The skill documents user-authorized USDC payment flows, so users should inspect payment terms before signing.
1
Files scanned
55
Lines analyzed
2
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
Financial Transaction Capability
The documented flow can create signed payment authorizations and complete paid endpoint requests. A user could spend USDC after approving a wallet signature.
The client flow explicitly directs a payer to sign typed data, construct an X-PAYMENT header, and retry a paid request. This is an intended financial capability, not evidence of credential theft or hidden transfers.
Risk Factors
Audited by: claude
Jul 10, 2026, 12:22 AM
Manual review of SKILL.md found a prompt-only payment workflow description with no executable code, network code, or prompt injection text. The static unscanned-file warning is a metadata parsing issue from the frontmatter, not a confirmed security risk.
0
Files scanned
0
Lines analyzed
1
Review items
0
False positives ignored
Confirmed security concerns (1)
Low
Unscanned file (invalid_frontmatter) — manual review required
[unscanned: invalid_frontmatter]
Force-confirmed metadata/low static finding; AI false-positive verdict rejected.
Audited by: codex