ClawHub
Back to skill

Security audit

asale-sell-gemini

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent and disclosed, but it needs Review because it handles Gemini OAuth credentials for resale and recommends direct remote-script installation.

Review this before installing if you are not comfortable letting the asale daemon copy and use your Gemini CLI OAuth credentials to sell subscription capacity. Prefer a verified installer or inspect the install script first, and use conservative price, concurrency, and daily-limit settings.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Credential Access

High
Category
Privilege Escalation
Content
floor, and comes back when it recovers. Nothing has to be switched off and on
again for that.

The credential comes from the macOS keychain entry `gemini-cli-oauth`
(account `main-account`) or from `~/.gemini/oauth_creds.json`. Both the flat
file format and the keytar nesting are read, so it does not matter which one the
CLI wrote.
Confidence
86% confidence
Finding
keychain

External Script Fetching

High
Category
Supply Chain
Content
name: asale-sell-gemini
version: 0.2.7
description: "Put a Gemini CLI subscription on the asale market: import it, set a price floor and a concurrency cap, and see which of its models are actually selling. 把 Gemini CLI 订阅挂到 asale 市场上：导入账号、设定价格底价与并发上限，并查看它的哪些模型真的在卖。"
metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run list_accounts before set_account_sell for provider gemini, and never lower minRatio without asking."}}
---

# asale-sell-gemini
Confidence
97% confidence
Finding
curl -fsSL https://asale.ai/dl/install.sh | sh

External Script Fetching

High
Category
Supply Chain
Content
name: asale-sell-gemini
version: 0.2.7
description: "Put a Gemini CLI subscription on the asale market: import it, set a price floor and a concurrency cap, and see which of its models are actually selling. 把 Gemini CLI 订阅挂到 asale 市场上：导入账号、设定价格底价与并发上限，并查看它的哪些模型真的在卖。"
metadata: {"clawdbot":{"emoji":"📤","requires":{"bins":["curl"]},"install":"curl -fsSL https://asale.ai/dl/install.sh | sh","installAlternative":"irm https://asale.ai/dl/install.ps1 | iex","homepage":"https://asale.ai","source":"https://github.com/asale-ai/asale","author":"asale","license":"see-repo","configLocation":"~/.asale/daemon.token","apiEndpoints":["127.0.0.1:9700"]},"openclaw":{"systemPrompt":"Drive the asale daemon at 127.0.0.1:9700 with the token from ~/.asale/daemon.token. Always run list_accounts before set_account_sell for provider gemini, and never lower minRatio without asking."}}
---

# asale-sell-gemini
Confidence
95% confidence
Finding
curl -fsSL https://asale.ai/dl/install.sh | sh

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.