ClawHub
Back to skill

Security audit

asale-sell-endpoint

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for selling a custom API endpoint, but its install/update path runs unverified remote code and it handles stored API keys.

Review before installing. Only run the installer if you trust asale.ai's live download path, or prefer a pinned/signed release if available. Before connecting an endpoint, verify the exact base URL and use a revocable, scoped API key because the daemon will probe with it and store it for selling traffic.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:64
Finding

Unpinned Remote Installer Is Executed Directly by a Shell

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL-cn.md:59
Finding

Unpinned Remote Installer Is Executed Directly by a Shell in the Localized Instructions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (11)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The installation metadata uses curl ... | sh and the PowerShell equivalent irm ... | iex, which execute remotely fetched code without prior integrity verification. If the distribution endpoint, TLS trust chain, DNS, or hosting account is compromised, users can be induced to run arbitrary code on their machines.

Content

Scanner excerpt · SKILL-cn.md (reported line 5)May include surrounding context.

md
name: asale-sell-endpoint
version: 0.2.7
description: "Sell a custom OpenAI-compatible endpoint on the asale market: probe it, connect it as an account, and price it above what its own tokens cost. 把自定义 OpenAI 兼容端点挂到 asale 市场上卖：先探测、接入成账号，并把价格定在它自己的 token 成本之上。"
metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. connect_custom_endpoint spends and stores the user's API key — confirm before calling. Never call remove_custom_endpoint."}}
---

# asale-sell-endpoint

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL-cn.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL-cn.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The metadata recommends installation via curl ... | sh and PowerShell iex, which executes remote code directly from the network without prior verification. If the hosting site, transport, or upstream distribution path is compromised, users could run attacker-controlled code immediately on their machines.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
name: asale-sell-endpoint
version: 0.2.7
description: "Sell a custom OpenAI-compatible endpoint on the asale market: probe it, connect it as an account, and price it above what its own tokens cost. 把自定义 OpenAI 兼容端点挂到 asale 市场上卖：先探测、接入成账号，并把价格定在它自己的 token 成本之上。"
metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. connect_custom_endpoint spends and stores the user's API key — confirm before calling. Never call remove_custom_endpoint."}}
---

# asale-sell-endpoint

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
[English](./SKILL.md) · [中文](./SKILL-cn.md)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-cn.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This workflow instructs the agent to submit a user-supplied API key to an arbitrary custom endpoint via connect_custom_endpoint, and the document states that the daemon will probe the remote server and then store the key. That creates a real secret-transmission risk: a mistyped, malicious, or attacker-controlled endpoint can harvest the credential, and the key is then retained locally for later use.

Content

Scanner excerpt · SKILL-cn.md (reported line 85)May include surrounding context.

1. 接入端点

bash
call connect_custom_endpoint '{"baseUrl":"https://api.example.com/v1","apiKey":"<key>","label":"house","minRatio":10,"concurrency":5}'

守护进程会先校验 URL、用这个 key 探测 GET {base}/models，然后才存任何东西——

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

文档在 AGENT 指令中要求“把 sellable_models 念回给用户”，且整份技能文件面向中文输出，没有说明这是用户自选语言，也没有给出仅适用于中文地区/用户的约束理由。按规则，强制特定语言而无用户 opt-in 属于自然语言政策违规。

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The skill instructs the agent to send a user-supplied API key to an arbitrary custom endpoint URL and explicitly says the daemon will probe GET {base}/models with that key before storing it. This creates a real credential-exposure risk because a mistyped, malicious, or attacker-controlled endpoint can harvest the API key, and the key is then persisted by the daemon.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

1. Connect the endpoint

bash
call connect_custom_endpoint '{"baseUrl":"https://api.example.com/v1","apiKey":"<key>","label":"house","minRatio":10,"concurrency":5}'

The daemon validates the URL and probes GET {base}/models with the key