ClawHub
Back to skill

Security audit

asale-buy-opencode

Security checks for vulnerabilities and agentic risk

Overview

The skill's runtime behavior is mostly coherent and disclosed, but its installer asks users to execute mutable remote scripts directly, so it should receive manual review before installation.

Review the installer before installing and prefer a signed or checksum-verified release if available. The skill will alter opencode configuration and can route future opencode usage through asale's buying flow, so only enable it when you understand the cost and account implications.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:5
Finding

Unverified Remote Installer Execution on Unix and Windows

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:5 and SKILL.md:64-66
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code

text
"install":"curl -fsSL https://asale.ai/dl/install.sh | sh",
"installAlternative":"irm https://asale.ai/dl/install.ps1 | iex"
sh
curl -fsSL https://asale.ai/dl/install.sh | sh
irm https://asale.ai/dl/install.ps1 | iex

The documentation also states that asale update reruns the same installer.

Technical Analysis

The Unix command pipes an HTTPS response directly into sh, while the Windows alternative passes a remotely retrieved PowerShell response directly to Invoke-Expression. In both cases, the downloaded content executes before the user can inspect it.

The installation process does not pin an installer version, validate a cryptographic digest, verify a release signature, or establish that the response matches the linked source repository. HTTPS protects the connection in transit but does not prevent a compromised domain, web server, deployment pipeline, or signing infrastructure from serving a changed payload after this Skill has been reviewed.

A companion daemon may be necessary for the declared switching functionality, but executing a mutable and unverified network response is not the minimum capability required to install it. A versioned and authenticated package would provide the required functionality with lower supply-chain risk.

Attack Path

  1. An attacker compromises asale.ai, its deployment pipeline, or another component capable of controlling the installer response.
  2. The attacker replaces install.sh or install.ps1 with a malicious payload.
  3. A user or agent follows the Skill's installation or update instructions.
  4. curl or PowerShell retrieves the attacker-controlled response.
  5. sh or Invoke-Expression immediately executes the response without integrity or signa ...[truncated 756 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the shell pipelines with downloads of versioned release artifacts.
  2. Pin an explicit installer or package version rather than using a mutable endpoint.
  3. Publish a cryptographic digest through an independently authenticated release channel and verify it before execution.
  4. Prefer signed platform packages and enforce signature verification.
  5. Download scripts to disk and require inspection or explicit confirmation before execution.
  6. Ensure asale update applies the same version-pinning and verification controls.
  7. Document the files, services, permissions, persistence mechanisms, and network endpoints introduced by installation.
  8. Do not request administrator or root privileges unless a documented installation operation strictly requires them.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL-cn.md:5
Finding

Localized Documentation Repeats Unverified Remote Installer Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL-cn.md:5 and SKILL-cn.md:59-61
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code

text
"install":"curl -fsSL https://asale.ai/dl/install.sh | sh",
"installAlternative":"irm https://asale.ai/dl/install.ps1 | iex"
sh
curl -fsSL https://asale.ai/dl/install.sh | sh
irm https://asale.ai/dl/install.ps1 | iex

The localized documentation also says that the update operation reruns the same installer.

Technical Analysis

This file independently exposes users to the same immediate remote-code execution mechanism. The response from https://asale.ai is sent directly to a Unix shell or PowerShell expression evaluator without version pinning, checksum validation, release-signature verification, or prior inspection.

The project identifies a homepage and GitHub source repository, but the audited files provide no mechanism proving that the downloaded response was built from that repository or corresponds to a reviewed revision. Consequently, the effective installer can be changed without changing the Skill package.

Installation of a local daemon may support the declared functionality, but a mutable shell pipeline exceeds the minimum installation risk necessary for that purpose.

Attack Path

  1. An attacker obtains control over the installer endpoint or its release infrastructure.
  2. The endpoint begins returning malicious shell or PowerShell code.
  3. A user follows the localized installation or update instructions.
  4. The downloaded response is immediately evaluated by the local command interpreter.
  5. The malicious code runs under the user's account without an integrity-verification step.

Impact Assessment

Exploitation enables arbitrary code execution within the installing user's security context. This can expose user-readable files, local application credentials, configuration d ...[truncated 374 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the direct curl | sh and Invoke-RestMethod | Invoke-Expression instructions.
  2. Provide immutable, versioned release artifacts with verified cryptographic signatures.
  3. Publish and validate checksums before executing downloaded content.
  4. Require the installer to be saved locally before execution.
  5. Make localized instructions enforce the same verification procedure as the primary documentation.
  6. Pin update operations to authenticated releases rather than rerunning a mutable installer URL.
  7. Clearly document required privileges and run installation with ordinary user permissions wherever possible.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The skill metadata instructs installation via 'curl ... | sh' (and PowerShell '... | iex'), which executes remote code directly without verification. If the hosting site, network path, or update channel is compromised, users could run arbitrary attacker-controlled code immediately during install or update.

Content

Scanner excerpt · SKILL-cn.md (reported line 5)May include surrounding context.

md
name: asale-buy-opencode
version: 0.2.7
description: "Switch opencode between buying from the asale market and using its own subscription, and see which running sessions are still on the old config. 在「从 asale 市场买」和「用它自己的订阅」之间切换 opencode，并查看哪些正在运行的会话还用着旧配置。"
metadata: {"clawdbot":{"emoji":"📥","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run buy_tools before set_buy_tool for tool opencode. tool_processes is listing only — never signal those pids."}}
---

# asale-buy-opencode

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL-cn.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL-cn.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill metadata instructs installation via curl ... | sh and PowerShell iex, which executes remote code fetched at runtime without integrity verification or pinning. If the delivery endpoint, TLS trust chain, CDN, or upstream publishing pipeline is compromised, users may immediately execute attacker-controlled code on their machine.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
name: asale-buy-opencode
version: 0.2.7
description: "Switch opencode between buying from the asale market and using its own subscription, and see which running sessions are still on the old config. 在「从 asale 市场买」和「用它自己的订阅」之间切换 opencode，并查看哪些正在运行的会话还用着旧配置。"
metadata: {"clawdbot":{"emoji":"📥","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run buy_tools before set_buy_tool for tool opencode. tool_processes is listing only — never signal those pids."}}
---

# asale-buy-opencode

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
[English](./SKILL.md) · [中文](./SKILL-cn.md)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-cn.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
the live file. asale edits whichever one is already there and creates the
  `.jsonc` when there is none.

The switch refuses to rewrite a config it cannot round-trip: `.jsonc` allows
comments and the writer emits plain JSON, so a commented file is left alone with
an error rather than silently stripped.