asale-sell-gemini

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:58 AM UTC
• Version: 1.0.0

Overview

The skill’s purpose is clear, but it needs Review because installation runs unverified remote scripts and the skill controls credential-backed selling of a Gemini subscription.

Install only if you trust asale’s installer delivery channel and are comfortable letting an agent operate a local daemon that can import Gemini credentials and put subscription capacity on a market. Prefer a verified, versioned installer, review sell settings in the asale UI, and confirm account import, enablement, price floor, concurrency, and daily limits before use.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:5

Finding

Unverified Remote Installer Is Executed Directly by POSIX Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5 and SKILL.md:64-66
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Critical

Vulnerable Code

yaml

metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run list_accounts before set_account_sell for provider gemini, and never lower minRatio without asking."}}

markdown

- **Install**: `curl -fsSL https://asale.ai/dl/install.sh | sh` (Windows:
  `irm https://asale.ai/dl/install.ps1 | iex`). `asale update` re-runs the same
  installer.

Technical Analysis

The installation procedure retrieves mutable content from an external domain and immediately passes it to sh. The Windows alternative similarly passes remotely retrieved content directly to Invoke-Expression. Neither path pins an installer version, validates a cryptographic checksum, verifies a digital signature, nor gives the user an opportunity to inspect the downloaded payload before execution.

TLS protects the network connection to the current endpoint, but it does not establish the long-term integrity of the installer. A compromise of the hosting server, domain, CDN, DNS infrastructure, deployment account, or installer publication process could change the effective code after this Skill has been reviewed.

The repository contains only documentation files and does not include the installer implementation. Consequently, the installer's commands, filesystem changes, network activity, persistence behavior, and privilege requ ...[truncated 2102 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace direct curl | sh and irm | iex execution with downloadable, versioned release artifacts.
2. Pin an exact installer or application version rather than retrieving a mutable latest script.
3. Publish a SHA-256 checksum through an independently protected release channel and verify it before execution.
4. Prefer signed release artifacts and verify the signature against a documented, pinned public key.
5. Download the installer to a local file first, fail closed if verification fails, and execute it only after explicit user approval.
6. Make the installer source available in the reviewed repository so its behavior and privilege requirements can be audited.
7. Ensure installation and updates run with ordinary user privileges unless a narrowly scoped operation demonstrably requires elevation.
8. Replace automatic installer reruns during asale update with a version-pinned and signature-verified update mechanism.
9. Document the files, services, network endpoints, and credentials accessed by installation and update operations.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL-cn.md:5

Finding

Unverified Remote Installer Is Executed Directly by Shell in Chinese Skill Definition

Content

View full analysis

Vulnerability Details

File Location: SKILL-cn.md:5 and SKILL-cn.md:59-61
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Critical

Vulnerable Code

yaml

metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run list_accounts before set_account_sell for provider gemini, and never lower minRatio without asking."}}

sh

curl -fsSL https://asale.ai/dl/install.sh | sh

powershell

irm https://asale.ai/dl/install.ps1 | iex

Technical Analysis

This localized Skill definition repeats the same unverified remote execution mechanism as the English definition. A mutable script is downloaded from an external endpoint and immediately interpreted by either a POSIX shell or PowerShell.

There is no pinned release version, checksum validation, signature verification, or inspection boundary between retrieval and execution. The fact that the source and homepage domains are identified does not prove that the payload returned at installation time is the same payload that was reviewed. The actual installer is absent from the project, preventing static verification of its behavior.

The documented update process reruns the remote installer, creating a continuing code execution channel whose effective payload can change after review. This installation mechanism is broader than necessary for the Skill's stated runtime behavior, which consists of making authenticated requests to a daemon on the loopback interface.

Attack Path

1. A use ...[truncated 1347 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct remote-to-interpreter pipelines from both metadata and documentation.
2. Distribute immutable, versioned installation packages from a verifiable release location.
3. Require checksum or digital-signature verification before any downloaded content is executed.
4. Pin the expected version and trusted signing identity in the Skill definition.
5. Download to a local file, verify it, present the intended action to the user, and require explicit confirmation before execution.
6. Use a similarly verified update mechanism instead of rerunning a mutable installer URL.
7. Include auditable installer source and a manifest of expected filesystem, credential, process, and network access.
8. Keep installation within ordinary user privileges and isolate any genuinely necessary privileged operation into a minimal, separately reviewed component.
9. Apply the corrected installation process consistently across all localized Skill files to prevent users from encountering different security guarantees.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill metadata recommends installation via curl -fsSL https://asale.ai/dl/install.sh | sh (and an equivalent PowerShell one-liner), which executes remote code directly without prior integrity verification. This is a high-risk supply-chain pattern because compromise of the distribution endpoint, DNS, TLS termination, or repository could lead to immediate arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL-cn.md (reported line 5)May include surrounding context.

md

name: asale-sell-gemini
version: 0.2.7
description: "Put a Gemini CLI subscription on the asale market: import it, set a price floor and a concurrency cap, and see which of its models are actually selling. 把 Gemini CLI 订阅挂到 asale 市场上：导入账号、设定价格底价与并发上限，并查看它的哪些模型真的在卖。"
metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run list_accounts before set_account_sell for provider gemini, and never lower minRatio without asking."}}
---

# asale-sell-gemini

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL-cn.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL-cn.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The metadata includes a one-line installer that pipes a remote script directly into sh, and a PowerShell equivalent that executes fetched content with iex. This pattern bypasses review and integrity verification, so if the distribution endpoint, DNS, TLS trust chain, or upstream hosting is compromised, arbitrary code executes immediately on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: asale-sell-gemini
version: 0.2.7
description: "Put a Gemini CLI subscription on the asale market: import it, set a price floor and a concurrency cap, and see which of its models are actually selling. 把 Gemini CLI 订阅挂到 asale 市场上：导入账号、设定价格底价与并发上限，并查看它的哪些模型真的在卖。"
metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run list_accounts before set_account_sell for provider gemini, and never lower minRatio without asking."}}
---

# asale-sell-gemini

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

[English](./SKILL.md) · [中文](./SKILL-cn.md)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The metadata system prompt instructs the agent to operate the local daemon using the token from ~/.asale/daemon.token, which is direct credential reuse for privileged actions on behalf of the user. This is dangerous because it turns the skill into an automation path over an authenticated local control plane, allowing account import and selling configuration changes without an independent authentication or consent boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs reading a local daemon token from ~/.asale/daemon.token and using it for authenticated RPC calls, but it does not frame that token as a sensitive credential requiring careful handling, redaction, or explicit user consent before use. Even though the token is intended for localhost use, it authorizes privileged actions on the user's asale session, so normalizing silent token handling increases the risk of credential misuse or leakage through logs, prompts, or tool output.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill provides concrete shell code to read the daemon token and attach it to every RPC request, operationalizing repeated use of a local secret for state-changing actions. While intended for localhost, this still exposes a sensitive bearer-style credential to the agent runtime and any surrounding logging or debugging surfaces, increasing the chance of unauthorized reuse.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-cn.md (reported line 41)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

--noproxy is not optional: a machine with HTTP_PROXY set sends even

127.0.0.1 through it, and the proxy answers 502 with an empty body,

which reads exactly like a broken daemon.

curl -sS --noproxy 127.0.0.1 -X POST "http://127.0.0.1:9700/rpc/$1"
-H 'content-type: application/json' -H "x-asale-token: $TOKEN" -d "$body" }

text

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL-cn.md (reported line 5)May include surrounding context.

md

name: asale-sell-gemini
version: 0.2.7
description: "Put a Gemini CLI subscription on the asale market: import it, set a price floor and a concurrency cap, and see which of its models are actually selling. 把 Gemini CLI 订阅挂到 asale 市场上：导入账号、设定价格底价与并发上限，并查看它的哪些模型真的在卖。"
metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run list_accounts before set_account_sell for provider gemini, and never lower minRatio without asking."}}
---

# asale-sell-gemini

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: asale-sell-gemini
version: 0.2.7
description: "Put a Gemini CLI subscription on the asale market: import it, set a price floor and a concurrency cap, and see which of its models are actually selling. 把 Gemini CLI 订阅挂到 asale 市场上：导入账号、设定价格底价与并发上限，并查看它的哪些模型真的在卖。"
metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run list_accounts before set_account_sell for provider gemini, and never lower minRatio without asking."}}
---

# asale-sell-gemini