ClawHub
Back to skill

Security audit

Pactum Marketplace

Security checks for vulnerabilities and agentic risk

Overview

This marketplace skill is mostly coherent, but it asks users to expose powerful account credentials in unsafe ways.

Review before installing. Do not send a JWT or API key through Telegram, chat, logs, or transcripts, and only store credentials in a secure secret manager. Use this skill only when you intentionally want Pactum marketplace actions, and confirm purchases, credit top-ups, escrow deposits, shipping-address submission, disputes, and payment release before execution.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:55
Finding

Live API Key Exposed in Output and Persisted Without Security Controls

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:353
Finding

Primary Marketplace JWT Disclosed to an External Telegram Bot

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (22)

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The trigger phrases include very generic terms like "buy", "pactum", "marketplace", and "search for", which are likely to activate on ordinary user requests unrelated to this specific marketplace. Over-broad activation increases the chance the skill engages unexpectedly and starts steering users into account creation, payment, or data-sharing flows without clear intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly instructs users to send their JWT to a Telegram bot, which is a credential-sharing pattern with a third party and no warning about token sensitivity or account takeover risk. Anyone with the JWT can typically act as the user for its validity period, exposing orders, messages, addresses, and payment-related actions.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Telling users to provide their JWT to a Telegram bot exposes a live bearer token to an external party. Because bearer tokens are often sufficient for authentication on their own, compromise of the bot, transport, logs, or operator access could directly enable unauthorized account actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
# ⚠️ ASK THE USER for their email address first
email = "user@example.com"  # ← get this from the user

r = requests.post(f"{WALLET_URL}/v1/register", json={"email": email})
r.raise_for_status()
# A 6-digit code has been sent to the user's email.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md
# ⚠️ ASK THE USER for their email address first
email = "user@example.com"  # ← get this from the user

r = requests.post(f"{WALLET_URL}/v1/register", json={"email": email})
r.raise_for_status()
# A 6-digit code has been sent to the user's email.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
# Step 2: Verify → get credentials
# ⚠️ Execute IMMEDIATELY after getting the code — codes expire quickly
r = requests.post(f"{WALLET_URL}/v1/verify", json={"email": email, "code": code})
r.raise_for_status()
data = r.json()
API_KEY = data["api_key"]         # pk_live_... — save this permanently

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
API_KEY = data["api_key"]         # pk_live_... — save this permanently
WALLET  = data["wallet_address"]  # 0x...

# Step 3: Get JWT token (do this immediately, don't ask the user)
r = requests.post(f"{BASE_URL}/market/auth/wallet", json={"api_key": API_KEY})
r.raise_for_status()
TOKEN = r.json()["token"]  # valid for 7 days

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
WALLET  = data["wallet_address"]  # 0x...

# Step 3: Get JWT token (do this immediately, don't ask the user)
r = requests.post(f"{BASE_URL}/market/auth/wallet", json={"api_key": API_KEY})
r.raise_for_status()
TOKEN = r.json()["token"]  # valid for 7 days

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md
WALLET  = data["wallet_address"]  # 0x...

# Step 3: Get JWT token (do this immediately, don't ask the user)
r = requests.post(f"{BASE_URL}/market/auth/wallet", json={"api_key": API_KEY})
r.raise_for_status()
TOKEN = r.json()["token"]  # valid for 7 days

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

Same register endpoint works for existing accounts

r = requests.post(f"{WALLET_URL}/v1/register", json={"email": email})

→ ask user for the code

r = requests.post(f"{WALLET_URL}/v1/recover", json={"email": email, "code": code}) API_KEY = r.json()["api_key"] # new key, old one invalidated

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

python
# Search items by keyword
r = requests.post(f"{BASE_URL}/market/discover", json={"q": "crypto funding rate"})
items = r.json()["items"]
for item in items:
    price = f"${item['price']}" if item["price"] > 0 else "FREE"

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

python
# Search items by keyword
r = requests.post(f"{BASE_URL}/market/discover", json={"q": "crypto funding rate"})
items = r.json()["items"]
for item in items:
    price = f"${item['price']}" if item["price"] > 0 else "FREE"

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md
headers = {"Authorization": f"Bearer {TOKEN}", "Content-Type": "application/json"}

# Check item.required first — if required.description is true, include "query"
r = requests.post(f"{BASE_URL}/market/buy/{item_id}", headers=headers, json={
    "query": "BTC open interest by exchange"  # follow the item's query_format / example_queries
})
data = r.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

md
headers = {"Authorization": f"Bearer {TOKEN}", "Content-Type": "application/json"}

# Check item.required first — if required.description is true, include "query"
r = requests.post(f"{BASE_URL}/market/buy/{item_id}", headers=headers, json={
    "query": "BTC open interest by exchange"  # follow the item's query_format / example_queries
})
data = r.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.

md
headers = {"Authorization": f"Bearer {TOKEN}", "Content-Type": "application/json"}

# Check item.required first — if required.description is true, include "query"
r = requests.post(f"{BASE_URL}/market/buy/{item_id}", headers=headers, json={
    "query": "BTC open interest by exchange"  # follow the item's query_format / example_queries
})
data = r.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md
# Top up credit ($1–$500)
# provider: "stripe" (card), "alipay", or "wechat"
r = requests.post(f"{BASE_URL}/market/credit/topup", headers=headers, json={
    "amount": 10,           # USD
    "provider": "stripe"    # or "alipay" or "wechat"
})

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

md
escrow_info = data["escrow"]

# Step 2: Deposit USDC to escrow contract
r = requests.post(f"{WALLET_URL}/v1/escrow-deposit", headers=wallet_headers, json={
    "escrow_contract": escrow_info["contract"],
    "usdc_contract": escrow_info["usdc_contract"],
    "order_id_bytes32": escrow_info["order_id_bytes32"],

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

md
tx_hash = r.json()["deposit_tx"]

# Step 3: Submit payment proof
r = requests.post(f"{BASE_URL}/market/buy/{item_id}", headers={
    **headers,
    "X-Payment-Proof": tx_hash,
    "X-Order-Id": order_id,

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 311)May include surrounding context.

Send a message to seller

python
r = requests.post(f"{BASE_URL}/market/orders/{order_id}/messages",
    headers={"Authorization": f"Bearer {TOKEN}", "Content-Type": "application/json"},
    json={"content": "Can you also include ETH data?"})

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 326)May include surrounding context.

Freezes payment. Admin will review and decide fund allocation.

python
r = requests.post(f"{BASE_URL}/market/orders/{order_id}/dispute",
    headers={"Authorization": f"Bearer {TOKEN}", "Content-Type": "application/json"},
    json={"reason": "Seller delivered wrong data"})

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill collects a full shipping address and transmits it to an external service without any explicit privacy notice, minimization guidance, or handling safeguards. This creates unnecessary privacy and compliance risk because users may disclose sensitive personal data without being informed how it is stored, used, or protected.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 339)May include surrounding context.

python
# ⚠️ ASK THE USER for their shipping details
r = requests.put(f"{BASE_URL}/market/address",
    headers={"Authorization": f"Bearer {TOKEN}", "Content-Type": "application/json"},
    json={"address": {
        "name": "John Doe", "street": "123 Main St",

Static analysis

No suspicious patterns detected.