Security audit

Tkseller

Security checks across malware telemetry and agentic risk

Overview

This seller automation skill has a coherent purpose, but it handles passwords, device identity, Discord server changes, gateway credentials, and background polling in ways users should review carefully.

Install only if you trust the publisher and the TKSeller backend. Use a private channel, avoid reusing passwords, confirm the backend should be HTTP/raw-IP before entering credentials, restrict the Discord bot to intended servers, and be prepared to remove saved data/token.json, revoke Discord/OpenClaw tokens, and stop polling if you uninstall.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code derives a persistent hardware-linked identifier from BIOS UUID, machine-id, MAC address, and shell commands, then hashes it into a stable device ID. This enables long-term device fingerprinting and account/device binding beyond what is necessary for a typical API client, creating privacy and tracking risk if the backend is compromised, misused, or if users were not clearly informed.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: This module imports child_process and later uses execSync/spawn together with PID management and forced termination, giving the skill host-level process control beyond simple card/message handling. In an agent skill context, detached process creation and SIGKILL/taskkill increase the blast radius of misuse, can interfere with unrelated local processes if PID state is stale or corrupted, and are not clearly constrained by the stated skill purpose.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code reads ~/.openclaw/openclaw.json and extracts gateway.auth.token, which is a local credential not implied by the skill description. Accessing user credentials directly lets the skill act with the user's gateway privileges and creates a trust-boundary violation if the skill is installed from an untrusted source.

Context-Inappropriate Capability

Low

Confidence: 79% confidence
Finding: The skill enumerates configured channels and derives targets across many communication platforms, which expands visibility into the user's environment beyond a narrowly described seller workflow. While likely intended for convenience, this broad discovery can expose metadata about installed integrations and route messages to unintended destinations if detection is wrong.

Description-Behavior Mismatch

Medium

Confidence: 85% confidence
Finding: The background loop sends buffered content to an external gateway using a bearer token and, on failure, persists that content to disk. That creates an undisclosed data egress and retention path that exceeds a narrowly described polling/login automation function, increasing the chance of sensitive seller or chat data being transmitted or stored longer than expected.

Context-Inappropriate Capability

Medium

Confidence: 78% confidence
Finding: This code launches an indefinite autonomous background polling process that continues until an internal stop flag changes. Even if intended for reliability, long-lived hidden execution expands the attack surface and can perform repeated actions, network activity, or data handling outside the user's immediate awareness.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script enumerates every guild the bot is in and installs the slash command into all of them, causing broad remote changes beyond a narrowly described direct-use skill. This can unintentionally modify third-party Discord servers without per-guild approval, violating least privilege and increasing the blast radius if the script is run with a privileged bot token.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The README documents a very broad natural-language trigger ("带货") that can activate the skill from ordinary chat. In a chat-integrated automation workflow, this increases the chance of accidental invocation, unintended side effects, and user confusion, especially because later steps include account login and content-generation actions.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The README instructs users to send usernames and passwords directly in chat but provides no warning about sensitive-data exposure, retention, or safer alternatives. Chat channels can be logged, visible to operators, bots, or other participants, making credential disclosure highly risky.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill declares very broad trigger conditions such as generic words and patterns that can cause the agent to invoke privileged automation on ordinary conversation. In this skill's context, invocation leads to immediate exec, API calls, credential handling, and background polling, so accidental matches can trigger real actions without clear user intent.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The installation-time invocation phrase is ambiguous and appears designed to bootstrap command registration from loosely phrased user text. That increases the chance of unintended execution during normal setup or conversation, especially because first-run behavior includes script execution and environment modification.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill explicitly orders the agent to suppress any preamble and immediately call exec, while also forbidding warnings or contextual disclosure. Because the skill performs credential collection, API operations, and cron registration, this removes an important safety checkpoint and makes covert execution materially easier.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill silently performs device fingerprint collection and invokes platform commands to read hardware identifiers without any user-facing disclosure in this file. Even if intended for licensing or anti-abuse, undisclosed collection of persistent identifiers is a security/privacy concern because it removes user agency and increases the blast radius of data misuse.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The login flow sends username, password, and a persistent device identifier to a remote service, but this file provides no warning, consent flow, or visible validation that the destination is trustworthy or restricted to HTTPS. Combining credentials with a stable device fingerprint increases account tracking and privacy risk, especially if configuration is altered or the backend is not fully trusted.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Using a gateway token pulled from a credential file in outbound requests without explicit consent or disclosure is dangerous because it silently grants the skill authenticated access to local gateway tools. In this context, the token can be reused for message sending, session inspection, and cron operations, so compromise or misuse affects multiple trusted capabilities.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The file performs detached subprocess creation and can forcibly terminate processes without any user-facing notice in the module. Hidden background execution is risky in agent skills because it persists beyond the initiating action, complicates user control, and may disrupt system state if termination logic is wrong.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The module downloads remote media and writes it to local disk without clear user disclosure, creating a silent data-ingestion path from arbitrary URLs into the local filesystem. This can lead to storage abuse, retention of untrusted content, and privacy concerns, especially since the skill is framed as messaging/card tooling rather than local caching/downloading software.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The code writes a temporary Python script and executes it through execSync, which introduces an unnecessary interpreter/shell execution path for image processing. In an agent skill, generating and running local scripts materially increases execution capability and attack surface, especially when combined with untrusted remote media inputs and hidden behavior.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: Buffered message content is POSTed to a gateway endpoint without any disclosure or consent mechanism visible in this file. If the buffer can contain sensitive chat, account, or operational data, this becomes a quiet exfiltration channel to an external service.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: When gateway delivery fails, the code writes pending output to a plaintext file in the data directory. Persisting possibly sensitive content locally without notice, retention control, or access protection increases the risk of unintended disclosure through local compromise, backups, or other processes on the host.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script performs remote configuration changes by registering commands across every joined guild without explicit warning or scoping. This is dangerous because an operator may expect a local setup action but instead triggers organization-wide changes across all servers the bot can access.

Ssd 3

High

Confidence: 99% confidence
Finding: The README not only asks users to submit credentials in chat, but also states they will be automatically saved, implying persistent storage of plaintext or equivalently sensitive secrets. In the context of a Discord/webchat-driven skill, this materially increases the blast radius through message history, backend logs, and compromised storage.

Ssd 3

High

Confidence: 97% confidence
Finding: The skill instructs the agent to treat a user's next message after a login prompt as a login command, even if the text is otherwise arbitrary. This can cause unrelated user content to be captured and forwarded as credentials, creating a high risk of credential mishandling, secret exfiltration, and unsafe interpretation of sensitive chat data.

Ssd 3

High

Confidence: 95% confidence
Finding: The skill normalizes collection of plaintext usernames and passwords directly in chat and routes them into automated processing. In context, the skill stores tokens, calls external APIs, and suppresses user-facing safety messaging, making plaintext credential handling especially dangerous and likely to expose secrets through logs, history, or unintended routing.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.install_untrusted_source, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: lib-js/api.mjs:85

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: lib-js/card-tools.mjs:441

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: lib-js/trigger.mjs:235

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: config.json:4

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: lib-js/api.mjs:51