ClawHub
Back to skill

Security audit

Agentplace

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent marketplace installer, but its install flow can persistently add third-party skills without strong package verification or safe extraction controls.

Install only if you trust Agentplace and the specific agent publisher. Before installing agents through this workflow, prefer a version with signed packages or published SHA-256 checksums, safe temporary directories, full archive inspection, and a clear way to remove installed skills. Do not paste real API keys into prompts or shared transcripts.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T08 · Insecure Dependencies

Error
Location
skill.md:88
Finding

Unverified Third-Party Agent Package Installation

Content
View full analysis
/download Paid agent: curl -s -H "x-api-key: ak_xxxx" https://api.agentplace.sh/marketplace/agents//download Example response: { "download_url": "https://cdn.agentplace.sh/agents/example.zip", "version": "1.0.0", "tier": "free" } Step 3 — Download agent package curl -sL "$download_url" -o /tmp/agent.zip Step 4 — Preview contents zipinfo -1 /tmp/agent.zip unzip -p /tmp/agent.zip SKILL.md > /tmp/agent-SKILL.md cat /tmp/agent-SKILL.md Step 5 — Final confirmation Install this agent now? (yes/no) Step 6 — Install locally unzip -qo /tmp/agent.zip -d /tmp/agent-preview/ mv /tmp/agent-preview ~/.openclaw/workspace/skills// rm /tmp/agent.zip ``` ### Technical Analysis The installation procedure trusts a `download_url` returned dynamically by the marketplace API and follows redirects through `curl -L`. It does not require the URL to belong to an approved origin and does not verify a cryptographic digest, signed manifest, publisher signature, or immutable package identity. Consequently, the package reviewed and installed is authenticated only by transport security at the URL ultimately contacted. A compromised marketplace API, CDN, publisher account, DNS path, or redirect destination could provide a package different from the expected artifact. The documented manual marketplace review is an administrative control and is not cryptographically bound to the downloaded bytes. Although the package is not immediately executed by these commands, it is installed into the OpenClaw skills directory. Its instructions or packaged components may subsequently be loaded or invoked with the permissions of the OpenClaw process. ### Attack Path 1. An ...[truncated 1197 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
skill.md:105
Finding

Incomplete Security Review of Agent Archive Contents

Content
View full analysis
/tmp/agent-SKILL.md cat /tmp/agent-SKILL.md Step 5 — Final confirmation Install this agent now? (yes/no) Step 6 — Install locally unzip -qo /tmp/agent.zip -d /tmp/agent-preview/ mv /tmp/agent-preview ~/.openclaw/workspace/skills// rm /tmp/agent.zip ``` ### Technical Analysis The preview process displays archive member names and the contents of only the top-level `SKILL.md`. It does not inspect the contents of scripts, executable files, nested archives, secondary instruction files, symbolic links, binary payloads, or configuration files. A benign `SKILL.md` therefore does not establish that the remaining package contents implement the described behavior. Filename listing also does not reliably reveal the semantics of scripts or distinguish safe data from malicious executable content. The final installation step extracts and installs every archive member, including files that were not substantively reviewed. This creates a review-to-install gap that can be exploited by placing the harmful behavior outside `SKILL.md`. ### Attack Path 1. An attacker publishes or substitutes an archive containing a plausible, harmless `SKILL.md`. 2. Malicious behavior is placed in another script, configuration file, nested archive, or instruction file. 3. `zipinfo -1` displays the filename but does not analyze its behavior. 4. Only `SKILL.md` is rendered for the user. 5. The user approves installation based on the incomplete preview. 6. All unreviewed archive members are extracted and installed. 7. If a concealed component is later loaded or invoked, it can act with the permissions granted to the OpenClaw process. ### Impact Assessment The issue allows undisclosed packa ...[truncated 400 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
skill.md:100
Finding

Unsafe Archive Extraction and Predictable Temporary Paths

Content
View full analysis
/tmp/agent-SKILL.md cat /tmp/agent-SKILL.md Step 5 — Final confirmation Install this agent now? (yes/no) Step 6 — Install locally unzip -qo /tmp/agent.zip -d /tmp/agent-preview/ mv /tmp/agent-preview ~/.openclaw/workspace/skills// rm /tmp/agent.zip ``` ### Technical Analysis The procedure uses fixed paths in the shared `/tmp` directory without securely creating a private working directory. Existing files, directories, or symbolic links at `/tmp/agent.zip`, `/tmp/agent-SKILL.md`, or `/tmp/agent-preview/` are not checked or removed safely. The extraction process also lacks explicit validation of normalized archive member paths, symbolic links, special files, archive size, expansion ratio, member count, and total extracted size. The quiet overwrite option can conceal replacement of existing temporary content. Stale files in an existing preview directory may also be included when the entire directory is moved into the skills workspace. The exact behavior of crafted paths depends on the installed ZIP implementation and platform protections, but the workflow does not establish the required safety invariants. ### Attack Path 1. A local attacker or previous failed run creates files, directories, or links at one of the predictable temporary paths. 2. Alternatively, a malicious package supplies traversal-like paths, links, excessive member counts, or highly compressed content. 3. The workflow writes to or extracts into those paths without secure exclusive creation or pre-validation. 4. Existing content may be overwritten, stale content may remain, or resource exhaustion may occur. 5. ...[truncated 677 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
skill.md:79
Finding

Shell Injection Exposure Through Unvalidated Query and Agent Identifiers

Content
View full analysis
" Get agent details: curl -s https://api.agentplace.sh/marketplace/agents/ ``` ```sh Free agent: curl -s https://api.agentplace.sh/marketplace/agents//download Paid agent: curl -s -H "x-api-key: ak_xxxx" https://api.agentplace.sh/marketplace/agents//download ``` ```sh mv /tmp/agent-preview ~/.openclaw/workspace/skills// ``` ### Technical Analysis The documentation does not define validation or safe encoding rules for `` and ``, although these values may originate from user input or marketplace data. The search query is placed into a URL without URL encoding. If an implementation builds and evaluates a shell command from this template, shell metacharacters may become dangerous depending on how substitution is performed. Even without command execution, characters such as `&`, `#`, `%`, or `?` can alter request semantics. The agent identifier is shown unquoted in URLs and a filesystem command. If copied into a shell command through direct string substitution, whitespace, shell metacharacters, glob characters, or option-like values can alter argument parsing or command behavior. An identifier containing path separators or traversal elements may also cause installation outside the intended child directory if destination containment is not separately enforced. This is an unsafe coding template rather than proof that a specific implementation currently evaluates attacker-controlled shell text. Exploitability depends on how an agent or wrapper translates the documented placeholders into actual commands. ### Attack Path 1. An attacker supplies a crafted search query or causes marketplace metadata ...[truncated 1076 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
92% confidence
Finding

The installation flow unzips an untrusted archive and moves its contents into the live skills directory without validating paths, contents, signatures, or destination safety. A malicious ZIP could exploit path traversal, overwrite files, or plant a harmful skill that later gains access to user data, tools, or execution flows despite the preview step.

Content

Scanner excerpt · skill.md (reported line 137)May include surrounding context.

md
unzip -qo /tmp/agent.zip -d /tmp/agent-preview/
mv /tmp/agent-preview ~/.openclaw/workspace/skills/<agent-id>/
rm /tmp/agent.zip

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 82)May include surrounding context.

md
List agents:

curl -s https://api.agentplace.sh/marketplace/agents

Search agents:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 82)May include surrounding context.

md
List agents:

curl -s https://api.agentplace.sh/marketplace/agents

Search agents:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 86)May include surrounding context.

md
List agents:

curl -s https://api.agentplace.sh/marketplace/agents

Search agents:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 90)May include surrounding context.

md
List agents:

curl -s https://api.agentplace.sh/marketplace/agents

Search agents:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 104)May include surrounding context.

md
List agents:

curl -s https://api.agentplace.sh/marketplace/agents

Search agents:

External Transmission

Medium
Category
Data Exfiltration
Confidence
74% confidence
Finding

This step sends a paid-agent API key in a command-line header, which can expose the secret through shell history, process listings, logs, or copied transcripts. While using an API key for authenticated download is legitimate, embedding it directly in ad hoc command examples is an unsafe secret-handling pattern.

Content

Scanner excerpt · skill.md (reported line 108)May include surrounding context.

md
Paid agent:

curl -s -H "x-api-key: ak_xxxx" https://api.agentplace.sh/marketplace/agents/<agent-id>/download

Example response: