MeshCore Marketplace

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:03 AM UTC
• Version: 1.0.0

Overview

The skill matches its marketplace purpose, but it handles paid-agent tokens and third-party data sharing with safeguards that are too loose for automatic use.

Review this before installing. Use a limited MeshCore token if possible, avoid placing it directly in shared config files, pin and review any npm or npx packages before running them, and require confirmation before sending sensitive text or files to any marketplace agent, including free agents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:43

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: README.md:43-45 and README.md:62-64
Vulnerability Type: Unpinned and immediately executed third-party dependencies
Risk Level: Medium

Vulnerable Code

bash

# Install the MeshCore CLI
npm install -g @meshcore/cli

bash

npx @meshcore/mcp-server

Technical Analysis

The documentation instructs users to install or execute npm packages without specifying reviewed versions or verifying package integrity. Both commands consequently resolve mutable package versions from the npm registry.

The npx @meshcore/mcp-server command is particularly sensitive because it can download and immediately execute the package's lifecycle scripts and application code. The global installation of @meshcore/cli can likewise execute installation scripts and exposes the system to all code contained in the currently published package version.

This is a supply-chain risk: the code ultimately executed can change after the skill has been audited. Compromise of the package, maintainer account, publishing credentials, package registry, or dependency tree could introduce malicious code without requiring any modification to this repository.

Attack Path

1. An attacker compromises a package maintainer, npm publishing credentials, the package itself, or one of its transitive dependencies.
2. The attacker publishes a malicious release under the same package name.
3. A user follows the documented command without selecting a previously reviewed version.
4. npm resolves and downloads the malicious release.
5. Package installation scripts or runtime code execute with the privileges of the user running npm.
6. The malicious package can access files, environment variables, network resources, and credentials available to that user.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the user who invokes npm. Potential conseq ...[truncated 429 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every documented package to an explicitly reviewed version, for example:

  bash

  npm install --save-dev @meshcore/cli@REVIEWED_VERSION
  npx --yes @meshcore/mcp-server@REVIEWED_VERSION
  

• Prefer project-local dependencies governed by a committed lockfile instead of global installations.
• Use npm ci with a reviewed lockfile in automated or reproducible environments.
• Verify package provenance, publisher identity, signatures where available, and registry integrity before installation.
• Review package lifecycle scripts and transitive dependencies before recommending execution.
• Run marketplace tooling in a sandbox or container with minimal filesystem access, network access, and environment credentials.
• Avoid running npm or npx as an administrator or root user.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29

Finding

Unsafe Interpolation of User-Controlled and Remote Values into Shell Commands

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:29-32, SKILL.md:43-45, and SKILL.md:51-65
Vulnerability Type: Potential shell command injection through textual command construction
Risk Level: Medium

Vulnerable Code

bash

curl -s "https://api.meshcore.ai/public/agents/search?query=SEARCH_TERM&limit=5" | jq '.[] | {name, description, pricingType, pricePerCall, id}'

bash

curl -s "https://api.meshcore.ai/public/AGENT_ID" | jq

bash

curl -s -X POST "https://api.meshcore.ai/gateway/call/AGENT_ID" \
  -H "Content-Type: application/json" \
  -d 'JSON_PAYLOAD'

bash

curl -s -X POST "https://api.meshcore.ai/gateway/call/AGENT_ID" \
  -H "Authorization: Bearer $MESHCORE_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d 'JSON_PAYLOAD'

Technical Analysis

The skill directs the agent to replace SEARCH_TERM, AGENT_ID, and JSON_PAYLOAD inside shell command templates. These values can originate from user requests or remote marketplace responses, but the instructions do not require strict validation, URL encoding, or shell-safe argument construction.

Double quotation marks do not prevent every form of shell interpretation. If untrusted text containing command substitution syntax such as $(...) or backticks is inserted into a double-quoted URL before shell execution, the shell may evaluate it locally. An unescaped double quote can also terminate the intended argument and introduce additional shell operators.

The JSON payload is enclosed in single quotation marks. A payload containing an apostrophe can terminate that quoted section. If the remaining text contains shell operators, it may alter command structure or execute an unintended local command.

Direct substitution of search terms also fails to apply URL encoding. Even when it does not achieve command execution, characters such as &, #, ?, spaces, or percent-encoded sequences can change ...[truncated 1832 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct shell commands by replacing placeholders in command strings.
• Prefer a structured HTTP client that accepts the URL, headers, query parameters, and body as separate values without invoking a shell.
• If curl must be used, pass search input through URL-aware argument handling:

  bash

  curl --fail-with-body --silent --show-error --get \
    --data-urlencode "query=$SEARCH_TERM" \
    --data-urlencode "limit=5" \
    "https://api.meshcore.ai/public/agents/search"
  

• Validate agent identifiers against the exact server-defined format. For example, use a strict allowlist for UUIDs or another documented identifier grammar and reject all unexpected characters.
• Generate request bodies with a JSON serializer such as jq --arg or jq --argjson; do not splice raw user text into quoted JSON.
• Supply generated payloads through files, standard input, or argument arrays rather than interpolating them into executable shell text.
• Require HTTPS explicitly and enable transport and HTTP error handling, such as --proto '=https', --fail-with-body, --show-error, and appropriate timeouts.
• Execute the skill with the minimum necessary environment and filesystem privileges so that a command-injection failure cannot expose unrelated credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README instructs users to create and export an API token but does not include guidance about treating it as a secret, rotating it, or avoiding exposure through shell history, logs, screenshots, and shared environments. While environment variables are a common mechanism, the missing safe-handling guidance increases the chance of accidental credential leakage and subsequent unauthorized use of paid agents or wallet features.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README tells users to execute an MCP server via npx @meshcore/mcp-server without pinning a specific version. That causes users to fetch and run whatever package version is current at execution time, creating a supply-chain risk if a malicious or compromised release is published later. In a skill whose purpose is to broker paid agent access and handle API tokens, this is more dangerous because the invoked server may gain access to credentials and marketplace actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The MCP configuration example places MESHCORE_API_TOKEN directly inside openclaw.json, a pattern that encourages storing credentials in plaintext configuration that may be committed to source control or shared with a project. If exposed, an attacker could use the token to access wallet features, invoke paid agents, and potentially incur charges or access account-linked data. Because this skill explicitly supports billing, token compromise has direct financial impact.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

Use semantic search to find agents by what they do:

bash

curl -s "https://api.meshcore.ai/public/agents/search?query=SEARCH_TERM&limit=5" | jq '.[] | {name, description, pricingType, pricePerCall, id}'

Replace SEARCH_TERM with what the user is looking for (e.g., "weather", "summarize text", "currency exchange").

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

Use semantic search to find agents by what they do:

bash

curl -s "https://api.meshcore.ai/public/agents/search?query=SEARCH_TERM&limit=5" | jq '.[] | {name, description, pricingType, pricePerCall, id}'

Replace SEARCH_TERM with what the user is looking for (e.g., "weather", "summarize text", "currency exchange").

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Use semantic search to find agents by what they do:

bash

curl -s "https://api.meshcore.ai/public/agents/search?query=SEARCH_TERM&limit=5" | jq '.[] | {name, description, pricingType, pricePerCall, id}'

Replace SEARCH_TERM with what the user is looking for (e.g., "weather", "summarize text", "currency exchange").

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

Use semantic search to find agents by what they do:

bash

curl -s "https://api.meshcore.ai/public/agents/search?query=SEARCH_TERM&limit=5" | jq '.[] | {name, description, pricingType, pricePerCall, id}'

Replace SEARCH_TERM with what the user is looking for (e.g., "weather", "summarize text", "currency exchange").

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

Use semantic search to find agents by what they do:

bash

curl -s "https://api.meshcore.ai/public/agents/search?query=SEARCH_TERM&limit=5" | jq '.[] | {name, description, pricingType, pricePerCall, id}'

Replace SEARCH_TERM with what the user is looking for (e.g., "weather", "summarize text", "currency exchange").

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

Calling a free external agent still sends user data off-platform to a third party, potentially including sensitive prompts or files encoded in JSON. The skill explicitly allows doing this without asking, which increases privacy risk despite no direct financial cost.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

For FREE agents (no auth needed):

bash

curl -s -X POST "https://api.meshcore.ai/gateway/call/AGENT_ID" \
  -H "Content-Type: application/json" \
  -d 'JSON_PAYLOAD'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

Calling a free external agent still sends user data off-platform to a third party, potentially including sensitive prompts or files encoded in JSON. The skill explicitly allows doing this without asking, which increases privacy risk despite no direct financial cost.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

For FREE agents (no auth needed):

bash

curl -s -X POST "https://api.meshcore.ai/gateway/call/AGENT_ID" \
  -H "Content-Type: application/json" \
  -d 'JSON_PAYLOAD'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This instruction sends data to an external service while attaching a bearer token, enabling authenticated paid operations. If misused, it can both expose sensitive user content to third parties and incur unauthorized charges on the associated MeshCore account.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

For PAID agents (auth required):

bash

curl -s -X POST "https://api.meshcore.ai/gateway/call/AGENT_ID" \
  -H "Authorization: Bearer $MESHCORE_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d 'JSON_PAYLOAD'

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The skill authorizes autonomous external calls to free agents without user consent. Even without direct billing, this permits unreviewed disclosure of user-provided data to third-party services and removes an important human approval checkpoint.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

1. **Always show pricing before calling a paid agent.** Tell the user: "This agent costs $X per call. Shall I proceed?"
2. **Wait for user confirmation before calling any paid agent.** Never call a paid agent without explicit approval.
3. **Free agents can be called without asking.** If `pricingType` is `FREE`, just call it.
4. **Show results clearly.** Format the agent's response in a readable way.
5. **If search returns no results**, suggest the user try different terms or browse all agents.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The workflow example instructs sending a user's long text to a third-party summarizer and then making an authenticated paid call after confirmation. This creates both privacy risk from transmitting potentially sensitive content and financial risk from token-backed usage.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

5. Show the weather data

**User: "Summarize this text: [long text]"**
1. Search: `curl -s "https://api.meshcore.ai/public/agents/search?query=text+summarizer&limit=3"`
2. Show results: "I found a Text Summarizer agent. It costs $0.01 per call. Want me to use it?"
3. Wait for confirmation
4. Call with auth: `curl -s -X POST ... -H "Authorization: Bearer $MESHCORE_API_TOKEN"`

Static analysis

No suspicious patterns detected.