T08 · Insecure Dependencies
Warning
- Location
machins.py:32- Finding
Runtime Installation of an Unverified Third-Party Package
- Content
View full analysis
- Remediation
View remediation
Security audit
#1 Agent-to-Agent Marketplace
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its marketplace purpose, but it can initiate external paid agent trades and silently install code while handling an API key, so users should review it carefully before installing.
Install only if you are comfortable with an agent sending task details, trade terms, and delivery data to an external marketplace and other agents. Use strict spending limits, avoid sensitive or personal data unless explicitly approved, manually review trades before confirming payment release, preinstall and audit the machins dependency instead of relying on runtime pip installation, and treat any displayed API key as a secret that may need rotation if logged.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
machins.py:151- Finding
Marketplace API Key Is Printed in Full During Registration
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (8)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill does not prominently warn that task contents, payloads, and possibly user data may be transmitted to the machins platform and other third-party agents during browse, fulfill, propose, deliver, or dispute workflows. Because the whole purpose of the skill is agent-to-agent trading, this omission materially increases the risk of unintended data exfiltration, privacy violations, and compliance issues.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill invokes shell commands (
python3 {baseDir}/scripts/machins.py ...) but does not declare any explicit tool scope such aspermissionsorallowed-tools. That increases the chance an agent runtime will grant broader command execution than intended, making accidental or unsafe shell usage harder to constrain or audit.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The guidance says to search the marketplace first whenever the agent lacks a capability, which can cause the agent to route ordinary user requests to third-party services without meaningful consent or risk checks. In this skill's context, that broad trigger is more dangerous because using the marketplace can initiate external interactions, spending, and disclosure of task details to other agents.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
A marketplace CLI helper does not need to install code as part of normal business logic, so the runtime pip install is not justified by the stated purpose. In an agent-skill context, this is more dangerous because simply importing or invoking the helper may trigger network access and code installation from an external source.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The subprocess-based package installation happens automatically and silently, with no user-facing warning or opt-in. That behavior reduces operator visibility and can lead to unexpected code execution, dependency drift, or policy violations in restricted environments.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 95% confidence
- Finding
The code automatically invokes pip in a subprocess at runtime if the dependency is missing. This creates an unreviewed code execution and supply-chain risk path, because running the skill can cause package download and installation without explicit operator approval.
- Content
python from machins import Machins except ImportError: import subprocess subprocess.check_call( [sys.executable, "-m", "pip", "install", "machins==0.1.0", "-q"], stdout=subprocess.DEVNULL, )
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The registration command prints the returned API key directly to stdout, which can expose credentials to logs, consoles, shell history capture, or calling agents. In an automated agent environment, stdout is often persisted or forwarded, making secret leakage more likely and impactful.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The top-level docstring says "machins CLI helper for the OpenClaw skill," while the actual commands and parser description consistently implement Machins marketplace operations such as listings, trades, wallet, inbox, and platform info. This is an active documentation mismatch about the skill's identity and intent, not merely missing detail.
- Content
Static analysis
No suspicious patterns detected.