Security audit

Attentionmarket

Security checks for vulnerabilities and agentic risk

Overview

This sponsored-deal search skill is disclosed, but it asks the agent to handle login credentials and store/use an API key in risky ways that need review before installation.

Review this carefully before installing. Only use it if you trust AttentionMarket/Supabase with your commercial queries and account login flow. A safer version would use a user-provided scoped API key or secure credential store, avoid raw password handling, avoid `source` on `.env`, serialize JSON with `jq`, stop printing secrets, enforce file permissions, and narrow activation to explicit sponsored/deal requests.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:30
Finding: Execution of a Shared Credential File as Shell Code
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:48
Finding: User Query Can Be Inserted into Shell Syntax Without Safe Encoding
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/setup.sh:29
Finding: Authentication JSON Is Constructed from Unescaped Credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/setup.sh:66
Finding: API Key Is Stored Without Enforced Permissions and Printed in Plaintext
Content: View full analysis
"${ENV_FILE}.tmp" 2>/dev/null || true mv "${ENV_FILE}.tmp" "$ENV_FILE" fi echo "AM_API_KEY=${api_key}" >> "$ENV_FILE" # Also export for current session export AM_API_KEY="$api_key" echo "" echo "========================================" echo " Setup complete!" echo "========================================" echo "" echo "Your API key has been saved to: ${ENV_FILE}" echo "Agent ID: ${agent_id}" echo "" echo "You can now use AttentionMarket in OpenClaw." echo "Try: \"find me taco deals near me\"" echo "" echo "To use in your current shell, run:" echo " export AM_API_KEY=${api_key}" ``` ### Technical Analysis The script writes the API key to `~/.clawdbot/.env` without setting a restrictive `umask` or explicitly enforcing mode `0600`. A newly created file therefore inherits permissions from the user's current umask. If the file already exists with permissive permissions, rewriting it does not correct them. The predictable `${ENV_FILE}.tmp` path is created with ordinary shell redirection rather than a securely created temporary file. This introduces avoidable race and symbolic-link risks in environments where another local process can manipulate the directory. Finally, the script prints the complete API key in an `export` command. Terminal logs, Agent transcripts, CI logs, screenshots, or monitoring systems may retain the secret. ### Attack Path 1. Setup runs under a permissive umask or uses an existing environment file with broad read permissions. 2. The API key is appended to that file. 3. Another local account or process reads the key. 4. Alternatively, an observer obtains the key from cap ...[truncated 873 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose is ad/deal search, but the instructions also direct interactive credential collection, authentication, secret retrieval/storage, and local environment sourcing. This mismatch is dangerous because users and reviewers may consent to a simple search skill while the skill actually performs privileged account setup and secret management operations.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The invocation criteria are very broad, covering product recommendations, commercial intent, local food, restaurants, and explicit ad searches. In context, this can cause the skill to activate for many ordinary recommendation queries and silently route user intent to a sponsored-results provider, increasing privacy risk and the chance of undisclosed ad influence.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: Sourcing ~/.clawdbot/.env after a setup script causes the skill to load locally stored secrets into the shell environment. In combination with prior credential collection and shell execution, this creates a significant risk of credential exposure to logs, child processes, later commands, or other skills sharing the environment.
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
This prompts for email + password, authenticates, and saves the API key. After setup, source the env file and proceed:

bash
source ~/.clawdbot/.env

If the user doesn't have an account, direct them to https://dashboard.attentionmarket.ai

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/setup.sh (reported line 11)May include surrounding context.
sh
SUPABASE_URL="https://peruwnbrqkvmrldhpoom.supabase.co" SUPABASE_ANON_KEY="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InBlcnV3bmJycWt2bXJsZGhwb29tIiwicm9sZSI6ImFub24iLCJpYXQiOjE3Njk5NjcwMDYsImV4cCI6MjA4NTU0MzAwNn0.FMCjeunas8ICKm9W9bo2hZwyrBttzTcJbplbAyl4XhU" CONFIG_FILE="${HOME}/.clawdbot/clawdbot.json" ENV_FILE="${HOME}/.clawdbot/.env" echo "========================================" echo " AttentionMarket - One-Time Setup"

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill uses shell commands (echo, bash, source, curl, jq) but does not declare any explicit tool scope or permissions. This weakens containment and reviewability because a host may allow broader shell execution than users expect, especially when the skill also performs setup and secret-handling steps.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The setup path instructs the agent to collect or facilitate collection of user email/password and then source a local env file. For a skill whose stated job is sponsored-search, this expands into credential handling and secret loading, increasing risk of credential exposure, phishing-like flows, and accidental leakage to logs or other processes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instructions say to send the user's query as context to an external API but do not require notifying the user that their query will leave the local environment. This is risky because user prompts may contain location, preferences, or other sensitive context that is transmitted to a third party without informed consent.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: This command transmits user-provided query content and an API key to an external endpoint. While external calls are expected for this skill, the lack of mandatory consent, data minimization, and clear privacy boundaries makes the transmission a real security/privacy issue in this context.
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
Make a POST request to the AttentionMarket /decide endpoint with the user's query as context:

bash
curl -s -X POST "https://peruwnbrqkvmrldhpoom.supabase.co/functions/v1/decide" \ -H "Content-Type: application/json" \ -H "X-AM-API-Key: $AM_API_KEY" \ -d "{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
User asks: "any taco deals near me?"

bash
curl -s -X POST "https://peruwnbrqkvmrldhpoom.supabase.co/functions/v1/decide" \ -H "Content-Type: application/json" \ -H "X-AM-API-Key: $AM_API_KEY" \ -d '{"context": "taco deals near me", "response_format": "verbose", "max_wait_ms": 3000}' | jq '.units[] | {title: .creative.title, body: .creative.body, cta: .creative.cta, click_url: .click_url, relevance: ._score.relevance}'

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest describes a search/ad-results skill, but the implementation performs account bootstrap: authenticating to Supabase, retrieving a developer API key, and persisting it locally. That mismatch is security-relevant because users may not expect a simple search skill to handle account credentials and durable secrets.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The setup script asks the user for their account email and password, sends them to a remote authentication endpoint, and uses the resulting session to fetch an API key. For a skill advertised as a sponsored-content search capability, this is broader-than-expected credential handling and increases the blast radius if the script, endpoint, or local environment is compromised.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The script transmits the user's email and password to an external service over the network. Even though HTTPS is used and external transmission is expected for authentication, it remains a sensitive operation that is more dangerous in this skill context because the capability is framed as a content-search skill rather than an account-login utility.
Content: Scanner excerpt · scripts/setup.sh (reported line 30)May include surrounding context.
sh
echo "Signing in..." # Authenticate with Supabase Auth auth_response=$(curl -s -X POST "${SUPABASE_URL}/auth/v1/token?grant_type=password" \ -H "apikey: ${SUPABASE_ANON_KEY}" \ -H "Content-Type: application/json" \ -d "{\"email\": \"${email}\", \"password\": \"${password}\"}")

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script writes the API key to a plaintext .env file in the user's home directory and also prints a command containing the full key to the terminal. This can expose the secret via shell history, terminal scrollback, screenshots, backups, or other local users/processes, especially if file permissions are not restricted.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The header comment implies users will 'never have to configure it again,' but later output states they still need to export the key for the current shell session. This is a direct mismatch between the file's stated intent and what the script actually accomplishes at runtime.
Content: No source excerpt is available for this finding.