# Manage Paid Proxy Access with x402socks

Agents may need regional proxy egress without a subscription account. This skill guides approved USDC purchases, token management, and verified TLS CONNECT routing through x402socks.

## Install

```bash
npx skillstore add x402socks/x402socks
```

## Metadata

- Status: approved
- Slug: x402socks-x402socks
- Version: 1.2.4
- Author version: 1.2.4
- Skillstore revision: r5
- Version status: valid
- Tree hash: df16939866aea38d963a9cab8979f6e442536fde8f9390072a50fd1412d2ad9e
- Author: x402socks
- GitHub username: x402socks
- License: MIT
- Repository: https://github.com/x402socks/skill/tree/e5f9bc9d6386307fc7373825225f6fc48c7e045f/skills/x402socks
- Ref: 9938f91a9ab0f5763a54332b129295339bf829dd
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: network, filesystem, external\_commands, env\_access
- Quality score: 82
- Quality tier: silver
- Public page: https://skillstore.pages.dev/skills/x402socks-x402socks
- Manifest: https://skillstore.pages.dev/api/skills/x402socks-x402socks/manifest

## Capabilities

- Check service health and list healthy, enabled proxy exits from the live node feed.
- Read package prices and decode live payment challenges, rejecting quote amounts above a configured USDC cap.
- Guide x402 purchases with explicit approval and TypeScript checks for scheme, network, asset, recipient, domain, and amount.
- Store proxy tokens using private files, permission checks, and atomic replacement without placing secrets in process arguments.
- Validate tokens, inspect account usage, rotate credentials, and submit signed ownership proofs for recovery.
- Test egress IP through TLS CONNECT and provide curl, Python, Node, and browser client examples.

## Use Cases

- Verify Regional Application Behavior: Choose an available regional exit and confirm egress before testing location-dependent responses from an application you control.
- Diagnose Proxy Connectivity: Check service health, node availability, token validity, and egress in sequence before replacing credentials or buying access again.
- Control Agent Network Spending: Record approved payment terms, enforce signing limits, and choose a package that matches an authorized automation task.

## Prompt Templates

### Inspect Availability

```
Check x402socks health and list healthy TLS CONNECT exits. Do not purchase access or request wallet secrets.
```

### Prepare a Purchase Quote

```
Quote time_6h with a maximum of 1 USDC. Show payment terms and entitlements, then wait for my approval before signing.
```

### Test Existing Access

```
Use my configured token file to validate access and test eu-north1 with TLS CONNECT. Report the egress IP without revealing credentials.
```

### Review Payment Integration

```
Review my TypeScript x402 integration against approved payment terms. Require signing-time checks and reject unexpected recipients, assets, domains, networks, or amounts.
```

## Limitations

- Purchases require USDC on Base, a signer, and external x402 libraries; the shell helper does not purchase packages itself.
- Python payment examples require additional client integration and signing-time validation before unattended use.
- Exit availability, prices, session limits, and fair-use quotas depend on the external service and can change.
- Proxy routing does not guarantee anonymity or target access; optional legacy transports expose reusable credentials without encryption.

## Best Practices

- Approve the full payment terms and enforce them against the actual signing challenge, not only an earlier catalog quote.
- Use certificate-verified TLS CONNECT and private token files; keep secrets out of arguments, logs, and chat transcripts.
- Check live node health and token validity before retrying; recover settled purchases instead of paying twice.

## Anti Patterns

- Letting a payment wrapper sign arbitrary challenges or treating a package name as unlimited spending approval.
- Enabling plaintext proxy authentication on untrusted networks or disabling certificate verification.
- Assuming cached prices, exit lists, or single-session packages support unlimited parallel automation.

## Security Audit

- Audited at: 2026-11-08T23:05:27.095\+00:00
- Summary: Most flags describe intended proxy operations, Markdown, or protected credential handling; no evidence found of credential harvesting or prompt injection. The opt-in legacy transport branch exposes reusable tokens without encryption. Rotation also invalidates the old token before local storage checks, risking loss of paid access.

## Stats

- Views: 2
- Downloads: 0
- Favorites: 1
- Popularity score: 0