asale-sell-claude

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:53 AM UTC
• Version: 1.0.0

Overview

This skill is review-worthy because it can sell a paid Claude subscription by importing local credentials and it installs or updates through unverified remote scripts.

Install only if you are comfortable with asale reading/importing local Claude or opencode credentials and using your subscription to serve marketplace buyers. Avoid running the pipe-to-shell installer unless you can independently verify it, and confirm the exact account, price floor, concurrency, and daily cap before enabling selling.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64

Finding

Unverified Remote Installer Execution in English Skill Definition

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5 and SKILL.md:64-66
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: High

Complete Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run list_accounts before set_account_sell for provider claude, and never lower minRatio without asking."}}

markdown

- **Install**: `curl -fsSL https://asale.ai/dl/install.sh | sh` (Windows:
  `irm https://asale.ai/dl/install.ps1 | iex`). `asale update` re-runs the same
  installer.

Technical Analysis

The Unix installation command downloads content from a mutable external URL and pipes it directly into sh. The Windows alternative applies the same pattern by passing downloaded PowerShell content to iex. Neither path allows inspection before execution or verifies an exact version, cryptographic checksum, or digital signature.

The installer is not included in the audited project, so its behavior cannot be statically verified. Although the download domain matches the declared project homepage, that relationship alone does not establish the integrity or immutability of the delivered script. The statement that asale update reruns the installer also makes the same unverified execution channel available after installation.

This behavior exceeds the minimum privileges needed by the Skill's declared runtime functionality. The Skill only needs to communicate with a loopback daemon, but the installation method permits t ...[truncated 1453 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct curl | sh and irm | iex installation patterns.
2. Publish versioned release artifacts from the declared source repository and pin installation instructions to an exact release.
3. Provide cryptographic SHA-256 checksums over a trusted channel and require verification before execution.
4. Prefer signed packages or release artifacts and document how users can verify the publisher signature.
5. Download the installer to a local file first so users can inspect it before running it.
6. Ensure updates resolve to an explicit version instead of executing mutable content from a generic URL.
7. Document every installed binary, modified file, created service, requested permission, and contacted network endpoint.
8. Run installation and daemon processes without administrator privileges unless a specific operation demonstrably requires elevation.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL-cn.md:59

Finding

Unverified Remote Installer Execution in Chinese Skill Definition

Content

View full analysis

Vulnerability Details

File Location: SKILL-cn.md:5 and SKILL-cn.md:59-61
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: High

Complete Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run list_accounts before set_account_sell for provider claude, and never lower minRatio without asking."}}

markdown

- **Installation**: `curl -fsSL https://asale.ai/dl/install.sh | sh` (Windows:
  `irm https://asale.ai/dl/install.ps1 | iex`). `asale update` reruns the same
  installer.

The second snippet is an English rendering of the surrounding localized prose; the executable commands are reproduced exactly as present in the file.

Technical Analysis

The localized Skill definition independently exposes the same unsafe installation mechanisms as the English definition. A remote Unix script is streamed directly into sh, while the Windows alternative evaluates remotely retrieved PowerShell through iex. No fixed artifact version, checksum validation, signature verification, or review step separates download from execution.

Because the downloaded installer is absent from the project, the audit cannot determine which files, services, permissions, dependencies, or network operations it creates. The effective payload may change after Skill review without any modification to SKILL-cn.md.

Immediate execution of an unrestricted remote script provides a much broader capability than the declared task requires. ...[truncated 1317 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace both direct execution commands with instructions for downloading a pinned release artifact.
2. Require checksum or publisher-signature verification before any artifact is executed.
3. Keep installation instructions consistent across all localized Skill files.
4. Publish the installer source with the project so its behavior can be audited.
5. Pin update operations to explicit versions and prevent silent execution of mutable installer content.
6. State the exact filesystem changes, background processes, permissions, and external connections made by installation.
7. Use the least-privileged user context and avoid requesting administrator access unless technically necessary and clearly justified.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (15)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The metadata recommends installation via 'curl | sh' and PowerShell 'iex', which executes remote code without integrity verification. This is dangerous because any compromise of the hosting domain, CDN, TLS termination, or update path can lead to immediate arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL-cn.md (reported line 5)May include surrounding context.

md

name: asale-sell-claude
version: 0.2.7
description: "Put a Claude Code / Claude subscription on the asale market: import it, set a price floor and a concurrency cap, and see which of its models are actually selling. 把 Claude Code / Claude 订阅挂到 asale 市场上：导入账号、设定价格底价与并发上限，并查看它的哪些模型真的在卖。"
metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run list_accounts before set_account_sell for provider claude, and never lower minRatio without asking."}}
---

# asale-sell-claude

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL-cn.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL-cn.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The skill instructs the agent/tooling to discover and import credentials from sensitive local stores, including Claude and opencode authentication files and macOS Keychain entries. Even if intended for account onboarding, this is dangerous because it normalizes credential harvesting from unrelated local applications and gives the daemon access to reusable subscription tokens.

Content

Scanner excerpt · SKILL-cn.md (reported line 77)May include surrounding context.

md

再开一次。

凭证按这个顺序取本机有的那个：macOS 钥匙串条目 `Claude Code-credentials`、
`~/.claude/.credentials.json`、以及 opencode 的 `~/.local/share/opencode/auth.json`
（它的 `anthropic` OAuth 项就是同一个 Claude 订阅，只是从另一个前门进的）。两处存的是
同一次登录时，token 指纹相同，会合并成一个账号而不是显示成两个。
## 使用方法

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

This section again directs discovery of Claude credentials from local authentication stores and merging them into a sellable account. The context makes the risk concrete: tokens from other tools are repurposed for marketplace activity, which could expose paid accounts to misuse or unintended monetization if the agent or daemon is compromised.

Content

Scanner excerpt · SKILL-cn.md (reported line 90)May include surrounding context.

call list_accounts # 已接入的账号，以及它们各自的条件

text

Claude 订阅会在 Claude Code 的钥匙串条目、`~/.claude/.credentials.json`
或 opencode 的 `auth.json` 里找到。三处存的是同一次登录时会合并成一个 `claude` 账号——
行上的 `sources` 会列出它在哪些存储里被看到过。

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The metadata recommends installation via 'curl ... | sh' and a PowerShell equivalent that directly executes remotely fetched code. This creates a supply-chain risk: if the distribution endpoint, transport, or upstream content is compromised, users will execute attacker-controlled code immediately.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: asale-sell-claude
version: 0.2.7
description: "Put a Claude Code / Claude subscription on the asale market: import it, set a price floor and a concurrency cap, and see which of its models are actually selling. 把 Claude Code / Claude 订阅挂到 asale 市场上：导入账号、设定价格底价与并发上限，并查看它的哪些模型真的在卖。"
metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run list_accounts before set_account_sell for provider claude, and never lower minRatio without asking."}}
---

# asale-sell-claude

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

[English](./SKILL.md) · [中文](./SKILL-cn.md)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The skill instructs the agent/daemon to discover and import credentials from multiple local stores, including Claude and opencode auth files and macOS keychain entries. Even if intended for legitimate account onboarding, this materially expands credential access and could expose or misuse subscription tokens if the skill, daemon, or surrounding agent is compromised or over-privileged.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

again for that.

The credential is whichever of these this machine has, in this order: the
macOS keychain entry `Claude Code-credentials`, `~/.claude/.credentials.json`,
and opencode's `~/.local/share/opencode/auth.json` (its `anthropic` OAuth entry
is the same Claude subscription reached through a different front door). Two
stores holding the same login share a token fingerprint and merge into one

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

This section confirms the workflow locates Claude subscription credentials in local credential stores and imports them into the asale system. The context makes the access operationally central to the skill, which increases risk because valuable authentication material is being repurposed for resale/market activity and could be abused beyond the user's intended scope.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

text

A Claude subscription is found in the Claude Code keychain entry, in
`~/.claude/.credentials.json`, or in opencode's `auth.json`. All three land as
one `claude` account when they hold the same login — `sources` on the row lists
every store it was seen in.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This file is written entirely in Chinese and presents the skill behavior and instructions only in that locale, while the policy requires flagging language or locale constraints that are imposed without user opt-in. Although it links to an English file, this file itself does not state that the agent should ask or honor the user's language preference.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-cn.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL-cn.md (reported line 5)May include surrounding context.

md

name: asale-sell-claude
version: 0.2.7
description: "Put a Claude Code / Claude subscription on the asale market: import it, set a price floor and a concurrency cap, and see which of its models are actually selling. 把 Claude Code / Claude 订阅挂到 asale 市场上：导入账号、设定价格底价与并发上限，并查看它的哪些模型真的在卖。"
metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run list_accounts before set_account_sell for provider claude, and never lower minRatio without asking."}}
---

# asale-sell-claude

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: asale-sell-claude
version: 0.2.7
description: "Put a Claude Code / Claude subscription on the asale market: import it, set a price floor and a concurrency cap, and see which of its models are actually selling. 把 Claude Code / Claude 订阅挂到 asale 市场上：导入账号、设定价格底价与并发上限，并查看它的哪些模型真的在卖。"
metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run list_accounts before set_account_sell for provider claude, and never lower minRatio without asking."}}
---

# asale-sell-claude

Static analysis

No suspicious patterns detected.