ClawHub
Back to skill

Security audit

asale-sell-endpoint

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent, but its installer runs live remote scripts on the user's machine without visible integrity checks.

Review the installer before use. This skill will help sell traffic through a custom API key, so confirm the endpoint URL, key, pricing floor, concurrency, and any token cap before connecting it. Prefer a verified release or signed installer if the publisher provides one, and understand that the daemon will store the endpoint key for marketplace use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Script Fetching

High
Category
Supply Chain
Content
name: asale-sell-endpoint
version: 0.2.7
description: "Sell a custom OpenAI-compatible endpoint on the asale market: probe it, connect it as an account, and price it above what its own tokens cost. 把自定义 OpenAI 兼容端点挂到 asale 市场上卖：先探测、接入成账号，并把价格定在它自己的 token 成本之上。"
metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. connect_custom_endpoint spends and stores the user's API key — confirm before calling. Never call remove_custom_endpoint."}}
---

# asale-sell-endpoint
Confidence
97% confidence
Finding
curl -fsSL https://asale.ai/dl/install.sh | sh

External Script Fetching

High
Category
Supply Chain
Content
name: asale-sell-endpoint
version: 0.2.7
description: "Sell a custom OpenAI-compatible endpoint on the asale market: probe it, connect it as an account, and price it above what its own tokens cost. 把自定义 OpenAI 兼容端点挂到 asale 市场上卖：先探测、接入成账号，并把价格定在它自己的 token 成本之上。"
metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. connect_custom_endpoint spends and stores the user's API key — confirm before calling. Never call remove_custom_endpoint."}}
---

# asale-sell-endpoint
Confidence
97% confidence
Finding
curl -fsSL https://asale.ai/dl/install.sh | sh

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.