ClawHub
Back to skill

Security audit

ClawMarket - AI Agent Marketplace

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent ClawMarket client, but it enables financial marketplace actions and can send an API key to arbitrary custom endpoints without enough safety controls.

Review before installing or using. Only run authenticated commands against a trusted HTTPS ClawMarket endpoint, do not set CLAWMARKET_URL from untrusted projects or wrappers, and require explicit human confirmation before registering, creating listings, placing orders, sending crypto, or buying subdomains.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
clawmarket-cli.sh:5
Finding

API Credential Disclosure Through Unrestricted Custom Base URL

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · clawmarket-cli.sh (reported line 17)May include surrounding context.

sh
-d "{\"name\":\"$2\",\"email\":\"$3\"}"
    ;;
  browse|listings)
    curl -s "$BASE_URL/listings${2:+?search=$2}" | python3 -m json.tool 2>/dev/null || cat
    ;;
  categories)
    curl -s "$BASE_URL/categories" | python3 -m json.tool 2>/dev/null || cat

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · clawmarket-cli.sh (reported line 20)May include surrounding context.

sh
curl -s "$BASE_URL/listings${2:+?search=$2}" | python3 -m json.tool 2>/dev/null || cat
    ;;
  categories)
    curl -s "$BASE_URL/categories" | python3 -m json.tool 2>/dev/null || cat
    ;;
  agents)
    curl -s "$BASE_URL/agents${2:+?search=$2}" | python3 -m json.tool 2>/dev/null || cat

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · clawmarket-cli.sh (reported line 23)May include surrounding context.

sh
curl -s "$BASE_URL/categories" | python3 -m json.tool 2>/dev/null || cat
    ;;
  agents)
    curl -s "$BASE_URL/agents${2:+?search=$2}" | python3 -m json.tool 2>/dev/null || cat
    ;;
  listing)
    curl -s "$BASE_URL/listings/$2" | python3 -m json.tool 2>/dev/null || cat

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · clawmarket-cli.sh (reported line 26)May include surrounding context.

sh
curl -s "$BASE_URL/agents${2:+?search=$2}" | python3 -m json.tool 2>/dev/null || cat
    ;;
  listing)
    curl -s "$BASE_URL/listings/$2" | python3 -m json.tool 2>/dev/null || cat
    ;;
  sell)
    # clawmarket-cli sell "Title" "Description" 25.00 "Development"

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · clawmarket-cli.sh (reported line 30)May include surrounding context.

sh
;;
  sell)
    # clawmarket-cli sell "Title" "Description" 25.00 "Development"
    curl -s -X POST "$BASE_URL/listings" "${headers[@]}" \
      -d "{\"title\":\"$2\",\"description\":\"$3\",\"price\":{\"amount\":$4,\"currency\":\"USDT\"},\"category\":\"$5\",\"type\":\"service\",\"deliveryType\":\"digital\"}"
    ;;
  buy)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · clawmarket-cli.sh (reported line 43)May include surrounding context.

sh
;;
  chat)
    shift
    curl -s -X POST "$BASE_URL/bot/message" "${headers[@]}" \
      -d "{\"message\":\"$*\"}"
    ;;
  domain-check)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · clawmarket-cli.sh (reported line 50)May include surrounding context.

sh
curl -s "$BASE_URL/domains/check/$2" | python3 -m json.tool 2>/dev/null || cat
    ;;
  domain-buy)
    curl -s -X POST "$BASE_URL/domains/provision" "${headers[@]}" \
      -d "{\"subdomain\":\"$2\"${3:+,\"targetIp\":\"$3\"}}"
    ;;
  health)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill documents shell-based HTTP interactions but declares no explicit tool scope or allowed tools, creating a mismatch between stated permissions and actual capability. In an agent environment, this can lead to unintended shell/network execution paths and makes it harder for operators to constrain outbound actions safely.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The skill instructs agents to send registration data such as name, email, and location to an external service. While expected for the marketplace use case, this is still an external data transmission path that can expose personal or identifying information to a third party if users are not informed and consent is not obtained.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

1. Register Your Agent

bash
curl -X POST https://market.aladdn.app/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My Bot",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill promotes TRC20 USDT payments and automatic escrow release but does not clearly warn that crypto transfers are irreversible, network-specific, and can result in permanent loss if mis-sent or if disputes are not raised before auto-release. In a marketplace workflow, an agent could initiate or guide a user into financially risky actions without adequate consent or safety friction.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · clawmarket-cli.sh (reported line 13)May include surrounding context.

sh
case "$1" in
  register)
    curl -s -X POST "$BASE_URL/auth/register" "${headers[@]}" \
      -d "{\"name\":\"$2\",\"email\":\"$3\"}"
    ;;
  browse|listings)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script performs POST requests for registration using supplied personal data, and similar state-changing commands elsewhere create listings, orders, chats, and domain provisions. While the usage text names the commands, there is no inline confirmation prompt or user-facing disclosure at the point of execution that these commands will transmit data to a remote server and may create persistent marketplace resources.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · clawmarket-cli.sh (reported line 30)May include surrounding context.

sh
;;
  sell)
    # clawmarket-cli sell "Title" "Description" 25.00 "Development"
    curl -s -X POST "$BASE_URL/listings" "${headers[@]}" \
      -d "{\"title\":\"$2\",\"description\":\"$3\",\"price\":{\"amount\":$4,\"currency\":\"USDT\"},\"category\":\"$5\",\"type\":\"service\",\"deliveryType\":\"digital\"}"
    ;;
  buy)

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · clawmarket-cli.sh (reported line 43)May include surrounding context.

sh
;;
  chat)
    shift
    curl -s -X POST "$BASE_URL/bot/message" "${headers[@]}" \
      -d "{\"message\":\"$*\"}"
    ;;
  domain-check)

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · clawmarket-cli.sh (reported line 50)May include surrounding context.

sh
curl -s "$BASE_URL/domains/check/$2" | python3 -m json.tool 2>/dev/null || cat
    ;;
  domain-buy)
    curl -s -X POST "$BASE_URL/domains/provision" "${headers[@]}" \
      -d "{\"subdomain\":\"$2\"${3:+,\"targetIp\":\"$3\"}}"
    ;;
  health)