ClawHub
Back to skill

Security audit

asale-buy-openclaw

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent, but its install and update path executes an unverified remote script, so it needs review before installation.

Install only if you trust asale.ai's live installer and update channel. Prefer downloading and inspecting the installer first, and look for a versioned, checksum- or signature-verified release. Before using the skill, understand that it can route OpenClaw through asale, use a signed-in asale account, and rewrite the OpenClaw config for future sessions.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:64
Finding

Unverified Remote Installer Executed Directly by a Shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:5 and SKILL.md:64-66; duplicated in SKILL-cn.md:5 and SKILL-cn.md:59-61
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Vulnerable Code Snippets:

From SKILL.md:5:

yaml
metadata: {"clawdbot":{"emoji":"📥","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run buy_tools before set_buy_tool for tool openclaw. tool_processes is listing only — never signal those pids."}}

From SKILL.md:64-66:

markdown
- **Install**: `curl -fsSL https://asale.ai/dl/install.sh | sh` (Windows:
  `irm https://asale.ai/dl/install.ps1 | iex`). `asale update` re-runs the same
  installer.

The same commands appear in the Chinese localization at SKILL-cn.md:5 and SKILL-cn.md:59-61:

markdown
- **安装**：`curl -fsSL https://asale.ai/dl/install.sh | sh`（Windows：
  `irm https://asale.ai/dl/install.ps1 | iex`）。`asale update` 会重跑同一个安装器。

Technical Analysis

The Unix installation command downloads mutable content from an external URL and immediately passes it to sh. The Windows alternative applies the same unsafe pattern by downloading a PowerShell script and executing it through Invoke-Expression.

Neither path pins an installer version, verifies a cryptographic checksum, validates a digital signature, or gives the user an opportunity to inspect the downloaded content before execution. The effective code is therefore determined by the remote server at installation time rather than by the audited Skill pack ...[truncated 2421 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the direct curl | sh and Invoke-Expression installation paths from both metadata and documentation.
  2. Publish versioned installer artifacts through a verifiable release channel, preferably the declared official source repository.
  3. Download the selected artifact to a local file without executing it.
  4. Pin the documentation and metadata to a specific reviewed version rather than a mutable URL.
  5. Publish a SHA-256 digest through an independently authenticated channel and require verification before execution.
  6. Prefer a signed release artifact and verify its signature against a documented, pinned maintainer key.
  7. Allow the user to inspect the downloaded installer and require explicit confirmation before running it.
  8. Apply the same controls to Windows installation instead of using Invoke-Expression.
  9. Change asale update to retrieve a versioned, signed update and verify it before execution.
  10. Document the files, services, network destinations, and permissions required by the installer, and ensure it does not request administrative privileges unless a specific operation requires them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The metadata instructs installation via curl ... | sh and PowerShell irm ... | iex, which executes remote code directly without prior verification. If the remote server, CDN, DNS, TLS trust chain, or upstream release pipeline is compromised, users may immediately run attacker-controlled code on their machines.

Content

Scanner excerpt · SKILL-cn.md (reported line 5)May include surrounding context.

md
name: asale-buy-openclaw
version: 0.2.7
description: "Switch OpenClaw between buying from the asale market and using its own subscription, and see which running sessions are still on the old config. 在「从 asale 市场买」和「用它自己的订阅」之间切换 OpenClaw，并查看哪些正在运行的会话还用着旧配置。"
metadata: {"clawdbot":{"emoji":"📥","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run buy_tools before set_buy_tool for tool openclaw. tool_processes is listing only — never signal those pids."}}
---

# asale-buy-openclaw

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL-cn.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL-cn.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The skill metadata recommends installing software by piping a remotely fetched shell script directly into sh (and PowerShell into iex on Windows). This creates a supply-chain execution risk: if the remote host, CDN, TLS trust chain, or distribution path is compromised, arbitrary code will execute immediately on the user's machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
name: asale-buy-openclaw
version: 0.2.7
description: "Switch OpenClaw between buying from the asale market and using its own subscription, and see which running sessions are still on the old config. 在「从 asale 市场买」和「用它自己的订阅」之间切换 OpenClaw，并查看哪些正在运行的会话还用着旧配置。"
metadata: {"clawdbot":{"emoji":"📥","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run buy_tools before set_buy_tool for tool openclaw. tool_processes is listing only — never signal those pids."}}
---

# asale-buy-openclaw

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
[English](./SKILL.md) · [中文](./SKILL-cn.md)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-cn.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text