x402 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited x402 (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use the npx [email protected] x402 commands to discover, inspect, and call paid API endpoints using the X402 payment protocol. Payments are made in USDC on Base.
three.ws runs two x402/payment stacks. Pick one deterministically: never settle a payment through a signing path the user didn't ask for.
okx-agent-payments-protocol): use only when the user names OKX/OnchainOS, or the 402 is one OKX handles specifically: a payment channel / voucher / session, permit2, upto/metered billing, MPP charge, or an a2a-pay paymentId. Hand off there and do not pay from here.The typical x402 workflow is:
Find paid services by keyword using CDP's vector search:
npx [email protected] x402 bazaar search <query> [-k <n>] [--network <network>] [--scheme <scheme>] [--max-price <price>] [--json]| Option | Description |
|---|---|
-k, --top <n> | Number of results, 1 to 20 (default: 20) |
--network <name> | Filter by chain (base, base-sepolia, polygon, solana, solana-devnet) |
--scheme <scheme> | Filter by payment scheme: exact or upto |
--max-price <price> | Maximum price in USD (e.g. 0.01) |
--asset <address> | Filter by payment asset address |
--pay-to <address> | Filter by recipient wallet address |
--extensions <type> | Filter by extension type (e.g. outputSchema, bazaar) |
--json | Output as JSON |
Browse all available resources:
npx [email protected] x402 bazaar list [--network <network>] [--full] [--refresh] [--json]| Option | Description |
|---|---|
--network <name> | Filter by chain (base, base-sepolia, polygon, solana, solana-devnet) |
--full | Show complete details including schemas |
--refresh | Re-fetch resource index from CDP API |
--json | Output as JSON |
Inspect an endpoint's x402 payment requirements without paying:
npx [email protected] x402 details <url> [--json]Auto-detects the correct HTTP method (GET, POST, PUT, DELETE, PATCH) by trying each until it gets a 402 response, then displays price, accepted payment schemes, network, and input/output schemas.
Call an x402 endpoint with automatic USDC payment:
npx [email protected] x402 pay <url> [-X <method>] [-d <json>] [-q <params>] [-h <json>] [--max-amount <n>] [--json]| Option | Description |
|---|---|
-X, --method <method> | HTTP method (default: GET) |
-d, --data <json> | Request body as JSON string |
-q, --query <params> | Query parameters as JSON string |
-h, --headers <json> | Custom HTTP headers as JSON string |
--max-amount <amount> | Max payment in USDC atomic units (1000000 = $1.00) |
--correlation-id <id> | Group related operations |
--json | Output as JSON |
Searching and discovering payment requirements are read-only and safe. Only x402 pay spends money.
x402 pay spends real USDC irreversibly. Before running it you MUST render a confirmation card and stop for an explicit yes/no from the user. Never pay in the same turn you discover or resolve the endpoint.
| Field | Show |
|---|---|
| Endpoint URL | The exact URL being called |
| Method | GET / POST / etc. |
| Max amount | The --max-amount ceiling in USDC (always set one for endpoints the user didn't choose) |
Rules:
--max-amount when the price was not chosen directly by the user, so a payment can never exceed the confirmed ceiling.# Search for weather-related paid APIs
npx [email protected] x402 bazaar search "weather"
# Search with more results
npx [email protected] x402 bazaar search "sentiment analysis" -k 10
# Check what an endpoint costs
npx [email protected] x402 details https://example.com/api/weather
# Make a GET request (auto-pays)
npx [email protected] x402 pay https://example.com/api/weather
# Make a POST request with body
npx [email protected] x402 pay https://example.com/api/sentiment -X POST -d '{"text": "I love this product"}'
# Limit max payment to $0.10
npx [email protected] x402 pay https://example.com/api/data --max-amount 100000
# Browse all bazaar resources with full details
npx [email protected] x402 bazaar list --fullX402 uses USDC atomic units (6 decimals):
| Atomic Units | USD |
|---|---|
| 1000000 | $1.00 |
| 100000 | $0.10 |
| 50000 | $0.05 |
| 10000 | $0.01 |
npx [email protected] auth login <email>) with sufficient USDC balance (npx [email protected] balance)npx [email protected] auth login <email> firstnpx [email protected] balance to check)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.