ClawHub
Back to skill

Security audit

Agos Marketplace

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it can create live marketplace listings and orders through external AGOS APIs without a strong confirmation or dry-run-first boundary.

Review this skill before installing. It is not showing deception or malware, but it can make real AGOS marketplace API calls that create listings and purchase orders. Only use it when you are comfortable sending the relevant wallet address and task/listing data to market.agos.fun, and require a human review step before running the live scripts, especially create_order.py because it has no dry-run mode.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The code’s behavior is narrowly focused on creating a marketplace listing/service manifest. It parses CLI arguments, validates input/output schemas, constructs a payload including supplier wallet and endpoint, and sends a POST request to the AGOS services API. This is consistent with one portion of the description—sell-side listing creation—but the declared purpose describes a substantially broader skill covering buy-side orders, payment prep, purchase tracking, and full workflow orchestration. Those capabilities are absent from the provided code chunk. There is no evidence of undeclared harmful behavior; the mismatch is that the description overstates the implemented functionality of this specific code.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The script clearly interacts with market.agos.fun and supports several declared buy-side behaviors: creating an AGOS/OpenClaw order, optionally preparing payment parameters, and optionally tracking purchase status. However, it does not create listings or perform any seller-side registration/listing workflow. Its primary implemented purpose is narrower than the declared description. This is a description-to-behavior mismatch because significant declared capabilities—especially sell-side listing creation and full buy/sell workflow execution—are absent from the supplied code chunk.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill advertises network-backed automation but does not declare any explicit tool scope or permissions boundary. That creates a governance and safety gap: an agent may invoke network-capable scripts without a clear, reviewable declaration of external access, making unintended outbound requests and data handling harder to control.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
---
name: agos-marketplace
version: 1.2.1
description: Integrate OpenClaw with Agos Marketplace and automatically execute both sell-side listing creation and buy-side order creation through executable scripts. Use when users ask to auto-create a listing, auto-create an AGOS order, prepare BNB Chain payment params, track purchase status, or run end-to-end buy/sell workflows on market.agos.fun.
---

# Agos Marketplace
Confidence
86% confidence
Finding
The description frames the skill as automatically executing marketplace actions, including listing and order creation, which are externally consequential operations. Autonomous execution without clear confirmation gates increases the risk of unintended purchases, listings, or business actions triggered from ambiguous prompts or prompt-injection-influenced workflows.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill encourages automatic creation of listings and orders against an external marketplace API without prominently warning that user-supplied data, wallet identifiers, and transaction-related parameters will be transmitted off-platform. This can lead to privacy leakage, uninformed consent, and accidental disclosure of sensitive commercial or blockchain metadata.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- `scripts/create_listing.py`: auto-create seller listing
- `scripts/create_order.py`: auto-create buyer purchase(order)

Always run scripts directly for automation. Do not ask users to manually craft curl unless debugging.

## Sell-Side Automation (Create Listing)
Confidence
93% confidence
Finding
The instruction to 'Always run scripts directly for automation' and avoid asking users to craft requests removes an important human review step before irreversible marketplace operations. In the context of a skill that can create orders and listings and prepare payment flows, this materially increases the chance of unauthorized or mistaken actions and makes prompt-manipulated execution more dangerous.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
interface:
  display_name: "Agos Marketplace"
  short_description: "Auto execute AGOS sell and buy flows"
  default_prompt: "Use this skill to auto-create AGOS listings (sell side) and purchases/orders (buy side), then prepare payment params and track status."
Confidence
95% confidence
Finding
Advertising 'Auto execute AGOS sell and buy flows' signals autonomous execution of marketplace transactions, which is risky because it can let the agent perform purchase or sale operations without a strong approval boundary. Given that the skill supports buy-side and sell-side workflows tied to payment preparation, erroneous or manipulated execution could directly cause unauthorized listings, orders, or fund movement preparation.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The default prompt broadly instructs the agent to 'auto-create' listings and orders, prepare payment parameters, and track status without stating explicit user-consent, validation, or scope constraints. In a marketplace and payment context, broad activation language can cause the agent to initiate financially meaningful actions from ambiguous user requests, increasing the risk of unintended transactions or misuse.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script automatically sends user-controlled order data, wallet addresses, and optionally triggers payment-preparation requests to a remote marketplace API without any explicit confirmation, safety interstitial, or clear disclosure at execution time. In the context of an agent skill designed to auto-execute buy-side marketplace actions, this increases the risk of unintended purchases, privacy leakage, or irreversible transaction preparation when upstream agents or users do not fully understand that real external actions will occur.

Static analysis

No suspicious patterns detected.