asale-buy-claude-code

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:55 AM UTC
• Version: 1.0.0

Overview

The skill is mostly transparent about routing Claude Code through asale, but its installer and updater execute mutable remote scripts and it changes Claude Code authentication settings.

Review before installing. The runtime behavior is disclosed, but only install if you trust asale’s remote installer delivery path and are comfortable with Claude Code’s future requests being routed through asale when the switch is enabled.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:5

Finding

Unverified Remote Installer Piped Directly into a Shell

Content

View full analysis

Remediation

View remediation

' install.sh | sha256sum --check - sh install.sh ``` 6. Apply equivalent Authenticode or detached-signature verification to the PowerShell installer; do not pipe network responses into `Invoke-Expression`. 7. Document the exact files, services, network endpoints, and permissions used by installation and updates. 8. Run installation with ordinary user privileges unless a narrowly defined operation explicitly requires elevation. 9. Ensure updates use the same pinned and verified release process rather than rerunning a mutable remote installer. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL-cn.md:5

Finding

Unverified Remote Installer Piped Directly into a Shell in Localized Documentation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The metadata instructs installation via 'curl ... | sh' (and PowerShell 'iex'), which executes a remotely fetched script without integrity verification or review. This creates a strong supply-chain risk: compromise of the host, CDN, DNS, TLS termination, or repo distribution path could lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL-cn.md (reported line 5)May include surrounding context.

md

name: asale-buy-claude-code
version: 0.2.7
description: "Switch Claude Code between buying from the asale market and using its own subscription, and see which running sessions are still on the old config. 在「从 asale 市场买」和「用它自己的订阅」之间切换 Claude Code，并查看哪些正在运行的会话还用着旧配置。"
metadata: {"clawdbot":{"emoji":"📥","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run buy_tools before set_buy_tool for tool claude. tool_processes is listing only — never signal those pids."}}
---

# asale-buy-claude-code

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL-cn.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL-cn.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

The skill explicitly modifies Claude Code's own configuration file at ~/.claude/settings.json to redirect traffic and alter authentication behavior. Changing another agent/tool's config is security-sensitive because it can silently reroute future requests, clear existing credentials, and affect subsequent sessions beyond the immediate action the user may expect.

Content

Scanner excerpt · SKILL-cn.md (reported line 100)May include surrounding context.

call set_buy_tool '{"tool":"claude","enabled":true}'

text

不传 `models` 就保持当前选择，传 `[]` 是清空。会改写的配置：`~/.claude/settings.json`（`env.ANTHROPIC_BASE_URL` / `ANTHROPIC_AUTH_TOKEN`）。

### 3. 说清楚哪些会话还在用旧配置

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The install command pipes a remotely fetched shell script directly into sh (and similarly uses iex on Windows), which gives the remote server full code execution on the user's machine without integrity verification or review. If the download endpoint, DNS, TLS termination, repository, or release pipeline is compromised, users will execute attacker-controlled code immediately.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: asale-buy-claude-code
version: 0.2.7
description: "Switch Claude Code between buying from the asale market and using its own subscription, and see which running sessions are still on the old config. 在「从 asale 市场买」和「用它自己的订阅」之间切换 Claude Code，并查看哪些正在运行的会话还用着旧配置。"
metadata: {"clawdbot":{"emoji":"📥","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run buy_tools before set_buy_tool for tool claude. tool_processes is listing only — never signal those pids."}}
---

# asale-buy-claude-code

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

[English](./SKILL.md) · [中文](./SKILL-cn.md)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

The skill explicitly rewrites Claude Code's local configuration at ~/.claude/settings.json, including authentication-related settings such as ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN. Modifying another tool's config and clearing or replacing credentials can redirect future traffic, alter billing/account usage, and persist beyond the current session, making this a high-risk capability even if it is the stated purpose of the skill.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

text

`models` omitted leaves the current selection alone; `[]` clears it. Config
rewritten: `~/.claude/settings.json` (`env.ANTHROPIC_BASE_URL` / `ANTHROPIC_AUTH_TOKEN`).

### 3. Say which sessions are still on the old config

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-cn.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text