asale-buy-hermes

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:51 AM UTC
• Version: 1.0.0

Overview

The skill’s runtime behavior is mostly disclosed and purpose-aligned, but its install/update path runs unverified remote scripts directly in a shell.

Review the install and update path before installing. The skill’s Hermes/asale actions are disclosed, but the documented installer runs live code from asale.ai directly in your shell; prefer a signed or checksum-verified release and avoid running it with elevated privileges.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63

Finding

Unverified Remote Installer Executed Directly by a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 63–65
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

markdown

- **Install**: `curl -fsSL https://asale.ai/dl/install.sh | sh` (Windows:
  `irm https://asale.ai/dl/install.ps1 | iex`). `asale update` re-runs the same
  installer.

The same commands also appear in the metadata at SKILL.md:5:

yaml

metadata: {"clawdbot":{"emoji":"📥","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run buy_tools before set_buy_tool for tool hermes. tool_processes is listing only — never signal those pids."}}

Technical Analysis

The installation instructions download a response from an external URL and immediately pass it to sh. The Windows alternative uses Invoke-RestMethod and sends its response to Invoke-Expression, producing the same direct execution behavior.

Neither command pins an immutable release, saves the installer for inspection, nor validates a checksum or cryptographic signature. The effective code can consequently change after the Skill package has been reviewed. The documented asale update operation re-executes the same mutable installer and therefore repeats the exposure.

The installer is hosted on the declared project domain, and the document references a public source repository. However, the audited package contains only documentation and does not include the installer, its expected digest, or a signature that would establish that the downloaded response corresponds to reviewe ...[truncated 1729 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace direct curl | sh and Invoke-Expression installation with downloads of immutable, versioned release artifacts.
2. Publish expected SHA-256 digests through an independently protected release channel and verify them before execution.
3. Cryptographically sign release artifacts and installer scripts, then validate the signature against a pinned project signing key.
4. Download the installer to a local file first so its source, digest, and contents can be inspected before execution.
5. Pin the Skill to a specific installer or release version rather than a mutable latest-version URL.
6. Require explicit user confirmation before executing installation or update code.
7. Publish the installer source in the declared repository and document how release artifacts can be reproducibly matched to reviewed source.
8. Ensure installation runs as an unprivileged user unless a specific operation demonstrably requires elevation. Separate any privileged step and request approval only for that narrowly scoped action.
9. Make updates use the same version pinning, signature verification, and user-approval controls instead of rerunning a mutable remote script.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL-cn.md:58

Finding

Unverified Remote Installer Executed Directly by a Shell in the Translated Documentation

Content

View full analysis

Vulnerability Details

File Location: SKILL-cn.md, lines 58–60
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

markdown

- **安装**：`curl -fsSL https://asale.ai/dl/install.sh | sh`（Windows：
  `irm https://asale.ai/dl/install.ps1 | iex`）。`asale update` 会重跑同一个安装器。

The same commands also appear in the metadata at SKILL-cn.md:5:

yaml

metadata: {"clawdbot":{"emoji":"📥","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run buy_tools before set_buy_tool for tool hermes. tool_processes is listing only — never signal those pids."}}

Technical Analysis

The translated document reproduces the same unsafe installation mechanism as the English document. On POSIX systems, an externally hosted response is piped directly into sh. On Windows, downloaded content is passed directly to Invoke-Expression.

There is no version pinning, checksum validation, signature verification, or opportunity to review the downloaded content before execution. Because the URL is mutable, the code executed by future users can differ from the code present when the Skill was audited. The update instruction expands the exposure by directing users to execute the same remote installer again.

Hosting the installer on the declared project domain does not provide artifact-level integrity. The audited folder does not contain the installer implementation or verifiable evidence linking the remote response to a reviewed release.

Attack Path

1. An attacker obtains the ability to ...[truncated 924 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct shell-pipeline and Invoke-Expression commands from the translated instructions and metadata.
2. Provide immutable, versioned release downloads from the declared source repository.
3. Publish and verify SHA-256 checksums and cryptographic signatures before any downloaded file is executed.
4. Save the installer locally, validate it, and require explicit user approval before execution.
5. Pin installation and update operations to reviewed versions.
6. Keep the translated documentation synchronized with a hardened installation process so it does not reintroduce unsafe commands removed from the primary document.
7. Execute installation with ordinary user privileges by default and isolate any demonstrably necessary privileged operation.
8. Include the installer source and release verification procedure in the public repository.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The metadata instructs installation via curl ... | sh (and PowerShell iex equivalent), which executes remote code directly from the network without prior integrity verification or user review. If the hosting domain, transport, CDN, or update path is compromised, users can be made to run arbitrary code immediately with their local privileges.

Content

Scanner excerpt · SKILL-cn.md (reported line 5)May include surrounding context.

md

name: asale-buy-hermes
version: 0.2.7
description: "Switch Hermes between buying from the asale market and using its own subscription, and see which running sessions are still on the old config. 在「从 asale 市场买」和「用它自己的订阅」之间切换 Hermes，并查看哪些正在运行的会话还用着旧配置。"
metadata: {"clawdbot":{"emoji":"📥","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run buy_tools before set_buy_tool for tool hermes. tool_processes is listing only — never signal those pids."}}
---

# asale-buy-hermes

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL-cn.md (reported line 40)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL-cn.md (reported line 40)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill metadata recommends installation via a remote script piped directly into a shell (curl ... | sh) and a PowerShell equivalent (irm ... | iex). This pattern executes unpinned code from the network without prior verification, so a compromised server, CDN, DNS path, or update channel could lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: asale-buy-hermes
version: 0.2.7
description: "Switch Hermes between buying from the asale market and using its own subscription, and see which running sessions are still on the old config. 在「从 asale 市场买」和「用它自己的订阅」之间切换 Hermes，并查看哪些正在运行的会话还用着旧配置。"
metadata: {"clawdbot":{"emoji":"📥","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run buy_tools before set_buy_tool for tool hermes. tool_processes is listing only — never signal those pids."}}
---

# asale-buy-hermes

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

[English](./SKILL.md) · [中文](./SKILL-cn.md)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-cn.md (reported line 40)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This file's operational instructions and user-facing guidance are written entirely in Chinese, which can impose a language requirement on users who invoke this skill through this document alone. Although there is a link to an English file, this file itself does not offer an in-flow language choice or opt-in before presenting all instructions in a fixed locale.

Content

No source excerpt is available for this finding.