T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:5- Finding
Unverified Remote Shell Installer Execution on Unix-like Systems
- Content
View full analysis
- Remediation
View remediation
Security audit
asale-buy-codex
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent and mostly disclosed, but it uses an unverified remote installer and rewrites Codex auth/config files to route future traffic through asale, which warrants Review before installation.
Install only if you are comfortable letting asale change Codex's provider and auth configuration and route future Codex requests through its local daemon. Prefer a signed, versioned installer with published checksums over the documented pipe-to-shell commands, and review the exact Codex config/auth changes and rollback behavior before enabling the switch.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL-cn.md:5- Finding
Unverified Remote Shell Installer Execution in the Chinese Skill Document
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (12)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The metadata includes a one-line remote installer (
curl ... | sh) and PowerShell equivalent (irm ... | iex), which execute code fetched from the network without verification. This is dangerous because a compromised distribution server, DNS/TLS interception failure, or upstream supply-chain issue would result in immediate arbitrary code execution on the user's machine.- Content
md name: asale-buy-codex version: 0.2.7 description: "Switch Codex between buying from the asale market and using its own subscription, and see which running sessions are still on the old config. 在「从 asale 市场买」和「用它自己的订阅」之间切换 Codex，并查看哪些正在运行的会话还用着旧配置。" metadata: {"clawdbot":{"emoji":"📥","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run buy_tools before set_buy_tool for tool codex. tool_processes is listing only — never signal those pids."}} --- # asale-buy-codex
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
--noproxy is not optional: a machine with HTTP_PROXY set sends even
127.0.0.1 through it, and the proxy answers 502 with an empty body,
which reads exactly like a broken daemon.
curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }text
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
--noproxy is not optional: a machine with HTTP_PROXY set sends even
127.0.0.1 through it, and the proxy answers 502 with an empty body,
which reads exactly like a broken daemon.
curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }text
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to modify sensitive Codex local configuration files (
~/.codex/config.tomland~/.codex/auth.json), including changing the active model provider and API key material. This creates a high-risk local integrity issue because the skill can reroute future Codex traffic through a third-party local daemon and alter authentication behavior without strong user-visible safeguards or explicit per-file consent.- Content
call set_buy_tool '{"tool":"codex","enabled":true,"models":["claude-fable-5"]}'
text 不传 `models` 就保持当前选择，传 `[]` 是清空。会改写的配置：`~/.codex/config.toml`（一个 `[model_providers.asale]` 块、活动的 `model_provider`、模型，以及一份生成的目录）和 `~/.codex/auth.json`（`OPENAI_API_KEY`）。 ### 3. 说清楚哪些会话还在用旧配置
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The metadata recommends
curl -fsSL https://asale.ai/dl/install.sh | shand a PowerShelliexequivalent, both of which execute remote code immediately without prior verification. This is dangerous because compromise of the hosting domain, transport, or installer pipeline leads directly to arbitrary code execution on the user's machine.- Content
md name: asale-buy-codex version: 0.2.7 description: "Switch Codex between buying from the asale market and using its own subscription, and see which running sessions are still on the old config. 在「从 asale 市场买」和「用它自己的订阅」之间切换 Codex，并查看哪些正在运行的会话还用着旧配置。" metadata: {"clawdbot":{"emoji":"📥","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run buy_tools before set_buy_tool for tool codex. tool_processes is listing only — never signal those pids."}} --- # asale-buy-codex
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md [English](./SKILL.md) · [中文](./SKILL-cn.md)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
--noproxy is not optional: a machine with HTTP_PROXY set sends even
127.0.0.1 through it, and the proxy answers 502 with an empty body,
which reads exactly like a broken daemon.
curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }text
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
The skill explicitly rewrites
~/.codex/config.tomland~/.codex/auth.json, including settingOPENAI_API_KEYand redirecting Codex to an asale-controlled local proxy. Modifying another tool's config and auth material is security-sensitive because it can reroute model traffic, alter trust boundaries, and affect credential handling for future Codex sessions.- Content
text `models` omitted leaves the current selection alone; `[]` clears it. Config rewritten: `~/.codex/config.toml` (a `[model_providers.asale]` block, the active `model_provider`, the model and a generated catalog) and `~/.codex/auth.json` (`OPENAI_API_KEY`). ### 3. Say which sessions are still on the old config
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This file is a Chinese-language variant of the skill and its instructions are written entirely in Chinese, but it does not state that language choice is optional within the skill itself. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the constraint is clearly documented and justified.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
--noproxy is not optional: a machine with HTTP_PROXY set sends even
127.0.0.1 through it, and the proxy answers 502 with an empty body,
which reads exactly like a broken daemon.
curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
--noproxy is not optional: a machine with HTTP_PROXY set sends even
127.0.0.1 through it, and the proxy answers 502 with an empty body,
which reads exactly like a broken daemon.
curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }text
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The description embeds both English and Chinese text directly, which imposes a specific locale/language presentation choice rather than letting the user select their preferred language. The policy for natural-language violations calls for flagging language or locale constraints when they are not explicitly optional or justified.
- Content