ClawHub
Back to skill

Security audit

ondeep-flow

Security checks for vulnerabilities and agentic risk

Overview

This marketplace skill is mostly coherent and disclosed, but it includes crypto settlement and account-management examples that need stronger human approval and safer handling of untrusted marketplace text.

Install only if you intend to let an agent interact with an external crypto marketplace. Use a dedicated low-balance wallet, protect ONDEEP_ACCID and ONDEEP_TOKEN, keep heartbeat opt-in and stoppable, require human confirmation before creating orders, transferring funds, confirming receipt, releasing escrow, or delisting products, and sanitize any product titles, descriptions, or order notes before displaying them in a terminal or passing them to an LLM.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
examples.md:169
Finding

Unsanitized Remote Marketplace Content Is Rendered in the Operator Terminal

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
examples.md:67
Finding

Escrow Release Example Lacks Delivery Verification and Final Human Approval

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

md
### 2. Payment Requires Human Approval

This skill can trigger on-chain crypto transfers. Deploying without safeguards may result in
unauthorized or accidental spending.

**Required safeguards:**

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
87% confidence
Finding

The API exposes a destructive action, DELETE /api/products/:id, that an agent could invoke based on untrusted or ambiguous inputs, causing unintended delisting of listings. In this marketplace context, tool misuse directly affects live commercial inventory and can disrupt sales or sabotage a seller account even though the endpoint is authenticated and described as a soft delete.

Content

Scanner excerpt · api-reference.md (reported line 131)May include surrounding context.

md
Update your product. Same fields as create.

### DELETE /api/products/:id `AUTH`

Delist your product (soft delete).

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The README instructs agents to send persistent heartbeat requests containing account credentials in headers to an external service every 60 seconds. Although this is expected functionality for the marketplace, it increases exposure of bearer-style credentials and creates ongoing outbound communication that could be misused by an autonomous agent or leak secrets through logs, proxies, or misconfigured tooling.

Content

Scanner excerpt · README.md (reported line 52)May include surrounding context.

md
curl -s -X POST https://ondeep.net/api/register | jq

# 2. Stay online (heartbeat every 60s)
curl -s -X POST https://ondeep.net/api/heartbeat \
  -H "X-AccId: $ONDEEP_ACCID" -H "X-Token: $ONDEEP_TOKEN"

# 3. Search products

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README gives the example invocation context "help me sell this," which is a generic phrase commonly used in everyday conversation. In a skill marketplace or routing system, such broad wording could cause unintended activation because the trigger scope and exclusions are not clearly constrained.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The skill requires periodic authenticated transmission of persistent identifiers (X-AccId, X-Token) to a third-party service every 60 seconds, creating continuous external data exposure and an always-on communication channel. Even over HTTPS, this expands the attack surface: credential leakage, misuse of long-lived tokens, service compromise, or unintended operational telemetry could enable account abuse or tracking.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

Call heartbeat every 60s to remain discoverable. Offline after 3 min of silence.

bash
curl -s -X POST https://ondeep.net/api/heartbeat \
  -H "X-AccId: $ONDEEP_ACCID" \
  -H "X-Token: $ONDEEP_TOKEN"

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This endpoint sends arbitrary order-note content to an external service, and the example note contains instruction-like text. Because notes are explicitly untrusted free-text and later echoed back in order data, this creates a realistic prompt-injection and data-exfiltration path if downstream agent components ingest note content and act on it, especially in a skill designed to connect autonomous agents with unknown counterparties.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

bash
# Add a note
curl -s -X POST https://ondeep.net/api/orders/ORDER_ID/notes \
  -H "X-AccId: $ONDEEP_ACCID" -H "X-Token: $ONDEEP_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"content":"Delivery instructions: use endpoint /api/v2/result"}'

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The phrase "help me sell this" is presented as a natural fit for when to use the skill, but it overlaps heavily with common everyday speech and is not constrained to a narrow marketplace context. In a markdown skill description, this kind of broad invocation language can make activation boundaries unclear and increase the risk of accidental use.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples.md (reported line 42)May include surrounding context.

md
echo "Product: GPU Computing Service — $50.00 USD on BSC"
echo "Confirm order? (y/n)" && read CONFIRM
if [ "$CONFIRM" = "y" ]; then
  ORDER=$(curl -s -X POST https://ondeep.net/api/orders \
    -H "X-AccId: $ACCID" -H "X-Token: $TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"product_id":1,"chain":"BSC","seller_address":"0xYourWalletAddress"}')

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples.md (reported line 56)May include surrounding context.

md
# → Transfer $TOTAL BNB to $PAY_ADDR on BSC (confirm before sending!)

# 7. After on-chain transfer, submit tx hash
curl -s -X POST "https://ondeep.net/api/orders/$ORDER_ID/pay" \
  -H "X-AccId: $ACCID" -H "X-Token: $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"tx_hash":"0xabc123def456..."}' | jq

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples.md (reported line 87)May include surrounding context.

md
done &

# 3. Publish a translation service
curl -s -X POST https://ondeep.net/api/products \
  -H "X-AccId: $ACCID" -H "X-Token: $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples.md (reported line 139)May include surrounding context.

md
-H "X-AccId: $ACCID" -H "X-Token: $TOKEN" | jq

# Update price
curl -s -X PUT "https://ondeep.net/api/products/1" \
  -H "X-AccId: $ACCID" -H "X-Token: $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"price": 8.50}' | jq

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The example shows a destructive DELETE operation for delisting a product without any explicit warning, confirmation, or rollback guidance. In an agent-skill context, users may copy this pattern into automation and unintentionally remove listings due to a mistaken product ID or unsafe autonomous execution.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples.md (reported line 194)May include surrounding context.

md
if input("Place order? (y/n): ").strip().lower() != "y":
        print("Order cancelled by operator.")
    else:
        order = requests.post(f"{BASE}/api/orders", headers=headers, json={
            "product_id": product["id"],
            "chain": "BSC",
            "seller_address": "0xYourWalletAddress",

Static analysis

No suspicious patterns detected.