T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:5- Finding
Unverified Mutable Remote Installer Is Executed Directly by the Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
asale-sell-codex
Security checks for vulnerabilities and agentic risk
Overview
The skill’s purpose is clear, but it uses an unverified remote installer for a daemon that imports subscription credentials and can sell account access on a marketplace.
Install only if you are comfortable running asale’s remote installer and letting its daemon import and retain a copy of your Codex/ChatGPT credentials for marketplace selling. Prefer verifying the installer from a trusted release with a pinned version and checksum/signature first, and review exactly which accounts are imported before enabling selling, especially because the sample import step imports everything found.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The skill metadata includes a one-line installer that pipes a remotely fetched shell script directly into sh, and a PowerShell equivalent using iex. This creates a software supply-chain and remote-code-execution risk because any compromise of the hosting domain, transport, or script contents leads to immediate code execution on the user's machine.
- Content
md name: asale-sell-codex version: 0.2.7 description: "Put a Codex / ChatGPT subscription on the asale market: import it, set a price floor and a concurrency cap, and see which of its models are actually selling. 把 Codex / ChatGPT 订阅挂到 asale 市场上：导入账号、设定价格底价与并发上限，并查看它的哪些模型真的在卖。" metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run list_accounts before set_account_sell for provider codex, and never lower minRatio without asking."}} --- # asale-sell-codex
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
--noproxy is not optional: a machine with HTTP_PROXY set sends even
127.0.0.1 through it, and the proxy answers 502 with an empty body,
which reads exactly like a broken daemon.
curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }text
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
--noproxy is not optional: a machine with HTTP_PROXY set sends even
127.0.0.1 through it, and the proxy answers 502 with an empty body,
which reads exactly like a broken daemon.
curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }text
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The skill metadata recommends installation via 'curl ... | sh' and the PowerShell equivalent 'irm ... | iex', which execute remote code directly without integrity verification or review. If the download endpoint, transport, hosting, or upstream release process is compromised, users could run arbitrary attacker-controlled code on their machine.
- Content
md name: asale-sell-codex version: 0.2.7 description: "Put a Codex / ChatGPT subscription on the asale market: import it, set a price floor and a concurrency cap, and see which of its models are actually selling. 把 Codex / ChatGPT 订阅挂到 asale 市场上：导入账号、设定价格底价与并发上限，并查看它的哪些模型真的在卖。" metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run list_accounts before set_account_sell for provider codex, and never lower minRatio without asking."}} --- # asale-sell-codex
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md [English](./SKILL.md) · [中文](./SKILL-cn.md)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
--noproxy is not optional: a machine with HTTP_PROXY set sends even
127.0.0.1 through it, and the proxy answers 502 with an empty body,
which reads exactly like a broken daemon.
curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
--noproxy is not optional: a machine with HTTP_PROXY set sends even
127.0.0.1 through it, and the proxy answers 502 with an empty body,
which reads exactly like a broken daemon.
curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
--noproxy is not optional: a machine with HTTP_PROXY set sends even
127.0.0.1 through it, and the proxy answers 502 with an empty body,
which reads exactly like a broken daemon.
curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }text
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md name: asale-sell-codex version: 0.2.7 description: "Put a Codex / ChatGPT subscription on the asale market: import it, set a price floor and a concurrency cap, and see which of its models are actually selling. 把 Codex / ChatGPT 订阅挂到 asale 市场上：导入账号、设定价格底价与并发上限，并查看它的哪些模型真的在卖。" metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run list_accounts before set_account_sell for provider codex, and never lower minRatio without asking."}} --- # asale-sell-codex
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md name: asale-sell-codex version: 0.2.7 description: "Put a Codex / ChatGPT subscription on the asale market: import it, set a price floor and a concurrency cap, and see which of its models are actually selling. 把 Codex / ChatGPT 订阅挂到 asale 市场上：导入账号、设定价格底价与并发上限，并查看它的哪些模型真的在卖。" metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run list_accounts before set_account_sell for provider codex, and never lower minRatio without asking."}} --- # asale-sell-codex