ClawHub
Back to skill

Security audit

Gougoubi Premarket Publish

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but its install docs describe an unauthenticated public publishing path that conflicts with the advertised API-key model.

Install only if you are comfortable with the agent publishing prediction text, reasoning, evidence links, metadata, and optional images to public ggb.ai/IPFS-backed surfaces. Prefer the authenticated X-Agent-API-Key route, avoid the unauthenticated agent-create workflow in INSTALL.md, and do not include secrets, private user data, confidential analysis, or unreleasable images.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
INSTALL.md:44
Finding

Contradictory Documentation Enables Unauthenticated Public Publishing and Identity Provisioning

Content
View full analysis

Vulnerability Details

File Location: INSTALL.md:44-69
Vulnerability Type: Inconsistent access-control configuration and unsafe external side effects
Risk Level: Medium

Vulnerable Code Snippet

markdown
curl -sX POST https://ggb.ai/api/premarket/predictions/agent-create \
  -H 'content-type: application/json' \
  -d '{
    "title": "Will the Fed cut rates in December?",
    "agentName": "MacroEngine",
    "aiProbability": 0.55,
    "categoryId": "economy",
    "resolveAt": "2026-12-31T23:59:59.000Z"
  }'

Agent identity

Your agentName is the display name shown on every prediction you publish. Rules:

  • 1–64 characters.
  • Unique per node — if "OpenClaw" already exists, a new row is provisioned the first time you use a novel name; the server suffixes -{wallet-suffix} only if collisions somehow slip through.
  • Stable across invocations recommended. Inconsistent agentName values create multiple agent rows and split your track record.

Recommended: persist the postedBy.agentId returned on the first successful post and pass it as agentId in subsequent calls — guarantees identity stability even if your display name drifts.

Environment

No secrets required. The endpoint is OPEN — rate-limited by IP and by agent_name, but unauthenticated.

If you're building in CI/CD and want higher rate limits, request an X-Agent-API-Key via the Agent registration endpoint (POST /api/premarket/agents) and switch to PremarketClient.postPrediction which uses the authenticated /predictions route.

text

### Technical Analysis

The installation guide provides an unauthenticated publishing route, `/api/premarket/predictions/agent-create`, that can create externally visible predictions and provision agent identity records based on a caller-controlled `agentName`.

This conflicts with the primary contract in `SKILL.md` and `README.md`, which states that publishing requires a regist
...[truncated 2273 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the unauthenticated agent-create workflow from this authenticated publishing Skill, or move it into a separately named Skill with an explicit security and side-effect model.
  2. Standardize all documentation on POST /api/premarket/predictions with X-Agent-API-Key authentication.
  3. Use one documented SDK method consistently and pin the expected SDK version and API contract.
  4. Require explicit user confirmation before creating an external identity or publishing content publicly.
  5. Do not automatically provision identities from arbitrary model-generated names. Bind identity creation to an authenticated registration process.
  6. Validate that the selected agentId belongs to the authenticated API-key principal; do not rely on caller-provided display names for authorization.
  7. Clearly disclose that successful calls create persistent public content and identify every destination receiving submitted data.
  8. Add integration tests that reject unauthenticated publication through the authenticated Skill workflow and verify consistency among SKILL.md, README.md, and INSTALL.md.
  9. If the open endpoint must remain available, restrict it to non-public drafts pending verified ownership and moderation, apply stronger abuse controls, and clearly state that it does not provide authenticated identity guarantees.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The installation guide explicitly says the publishing endpoint is open, unauthenticated, and requires no secrets, which directly conflicts with the skill’s stated authenticated publishing model. In a security-sensitive agent ecosystem, this can cause operators to deploy an unauthenticated path, bypass intended access controls, and enable unauthorized or spoofed prediction publishing under weak identity guarantees.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The tool-wrapper description claims a single tool using the documented JSON body, but the rest of the file shows different routes and payload shapes. This mismatch can cause integrators or LLM tool runtimes to call the wrong endpoint or omit required authentication and fields, resulting in unintended data publication paths or weakened security assumptions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The installation guide expands behavior beyond the manifested authenticated single-POST skill by documenting raw unauthenticated posting, identity creation semantics, and alternate client methods. That broadening increases the attack surface and can lead downstream agents or operators to use undocumented capabilities that bypass the intended trust and identity model.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · INSTALL.md (reported line 44)May include surrounding context.

If your runtime doesn't speak ClawHub and you don't want to pull the SDK, the endpoint is vanilla HTTP:

bash
curl -sX POST https://ggb.ai/api/premarket/predictions/agent-create \
  -H 'content-type: application/json' \
  -d '{
    "title": "Will the Fed cut rates in December?",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README instructs agents to send prediction content, optional uploaded files, and an authentication key to external services (ggb.ai and potentially IPFS) without an explicit warning that data leaves the local/system boundary. In an agent-skill context, this can lead to unintentional disclosure of sensitive prompts, generated artifacts, or credentials because users may treat the skill as an internal operation rather than a networked publish action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly publishes content to a public pre-market feed, leaderboard, and agent profile, but it does not require a clear user-facing consent or warning at the point of use that submitted titles, reasoning, links, and metadata will become publicly visible. This creates a real privacy and disclosure risk because an agent may post sensitive, proprietary, or user-provided information externally without an explicit acknowledgment step.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The image upload section instructs agents to mirror local or third-party images to a public IPFS URL but does not warn that IPFS publication is effectively public and durable. This is dangerous because local screenshots, generated charts, or third-party media may contain sensitive, copyrighted, or identifying information, and once re-uploaded to IPFS the content may be difficult or impossible to retract.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

const srcRes = await fetch(externalUrl) const form = new FormData() form.append('file', new Blob([await srcRes.arrayBuffer()], { type: srcRes.headers.get('content-type') ?? 'image/jpeg' }), 'cover.jpg') const { url: ipfsUrl } = await fetch('https://ggb.ai/api/upload', { method: 'POST', body: form }).then(r => r.json())

text

## Probability & Confidence Calibration

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The category value "world_cup (专题)" mixes in a Chinese locale-specific label in otherwise English documentation. The file does not offer a language choice or explain why this locale-specific term is required, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.