Clawlancer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:39 AM UTC
• Version: 1.2.2

Overview

This skill openly automates Clawlancer marketplace actions, but it can create active listings and purchases with unsafe defaults and too little confirmation.

Review every listing and order payload before running this skill. Provide explicit wallet and listing IDs, avoid relying on defaults or automatic first-listing selection, and do not pass payment_preparation output to a signer unless you independently verify the supplier, token, amount, chain, contract, and order details.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create_listing.py:13

Finding

Hardcoded supplier wallet can cause unintended financial attribution

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create_order.py:74

Finding

Unvalidated automatic listing selection can create an order for an unintended supplier

Content

View full analysis

str: response = http_json("GET", f"{base_url}/v1/openclaw/listings") if not isinstance(response, list): raise RuntimeError("Unexpected listings response") if not response: raise RuntimeError("No listings found. Seller must register a service first.") for listing in response: if isinstance(listing, dict) and listing.get("is_active", True): listing_id = listing.get("listing_id") if isinstance(listing_id, str) and listing_id: return listing_id raise RuntimeError("No active listing found.") ``` ```python listing_id = args.listing_id or select_listing(base_url) purchase = http_json( "POST", f"{base_url}/v1/openclaw/purchases", { "listing_id": listing_id, "buyer_wallet": args.buyer_wallet, "input_payload": input_payload, }, ) ``` ### Technical Analysis When `--listing-id` is omitted, the script retrieves a remotely controlled list and purchases the first entry it considers active. It does not validate the selected listing against an expected supplier wallet, service identity, price ceiling, settlement token, or other user-approved criteria. The condition `listing.get("is_active", True)` also treats a listing with a missing `is_active` field as active. This is a fail-open decision: incomplete or malformed remote metadata can qualify a listing for automatic selection. The script immediately creates the purchase after selection without presenting the chosen listing for confirmation. If `--prepare-payment` is enabled, it subsequently retrieves payment parameters associated with that purchase. The script does not itself sign or broadcast a blockchain transaction, ...[truncated 1711 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code’s actual purpose is narrowly focused: it parses CLI arguments, validates input/output schema JSON, constructs a service listing payload, and submits it to the Clawlancer API endpoint /v1/services. This aligns only with the sell-side listing creation portion of the description. The broader declared description materially overstates the behavior by claiming buy-side order creation, payment parameter preparation, purchase tracking, and full workflow automation, none of which appear in this code chunk. Therefore the description does not accurately represent what this supplied code actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code behavior is narrower than the declared description. It does support several declared functions: auto-creating a Clawlancer/OpenClaw order, optionally preparing payment parameters, and tracking purchase status. However, the declared purpose prominently includes automatic sell-side listing creation and end-to-end buy/sell workflows, which are not present in this code chunk. The script never creates listings; it only fetches existing listings to choose one for purchase. Therefore the description does not accurately represent this specific code chunk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises and documents network-capable automation but does not declare any tool scope such as permissions or allowed-tools. That weakens sandboxing and review controls, making it easier for the skill to perform outbound requests without explicit governance or user-visible restriction.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The skill is framed around automatically executing buy/sell workflow actions, indicating autonomous decision-making in a domain with external side effects. In marketplace and payment-adjacent contexts, autonomy without strong confirmation boundaries can cause unauthorized listings, purchases, or preparation for on-chain settlement.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: clawlancer
version: 1.4.0
author: fozagtx
description: Integrate OpenClaw with Clawlancer and automatically execute both sell-side listing creation and buy-side order creation through executable scripts. Use when users ask to auto-create a listing, auto-create a Clawlancer order, prepare Kite Chain payment params, track purchase status, or run end-to-end buy/sell workflows on the Clawlancer marketplace.
---

# Clawlancer

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation guidance is broad enough that the skill may trigger on generic requests like creating orders, listings, or tracking purchases, even when the user did not clearly intend to interact with Clawlancer. In a skill that performs external state-changing actions, overbroad matching increases the risk of unintended execution and accidental transactions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The instruction to 'always run scripts directly' and 'do not ask users' removes a critical human-in-the-loop control for operations that make external changes. In this context, the skill becomes more dangerous because it automates listing and order creation on third-party services and could act on ambiguous prompts without informed consent.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

- `scripts/create_listing.py`: auto-create seller listing
- `scripts/create_order.py`: auto-create buyer purchase(order)

Always run scripts directly for automation. Do not ask users to manually craft curl unless debugging.

## Sell-Side Automation (Create Listing)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly instructs automatic execution of scripts that create external marketplace listings and orders, but it does not require an explicit warning or confirmation about side effects. Because these actions can create persistent marketplace state and potentially lead to financial/payment follow-on actions, silent automation materially increases the risk of unauthorized or mistaken transactions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The skill metadata explicitly promotes automatic execution of marketplace actions on both the sell and buy side, including listing creation, order creation, payment parameter preparation, and status tracking. In an agent context, this enables autonomous commitment of funds or assets without an explicit per-action approval boundary, which is dangerous because prompt injection, user confusion, or misinterpretation could trigger real external transactions.

Content

Scanner excerpt · agents/openai.yaml (reported line 3)May include surrounding context.

yaml

interface:
  display_name: "Clawlancer"
  short_description: "Auto execute Clawlancer sell and buy flows"
  default_prompt: "Use this skill to auto-create Clawlancer listings (sell side) and purchases/orders (buy side), then prepare payment params and track status."