Security audit
Ampere marketplace
Security checks for vulnerabilities and agentic risk
Overview
This marketplace skill is not clearly malicious, but it gives an agent broad authority to search an external marketplace and install remote ZIP packages into persistent OpenClaw skills with limited safety controls.
Install only if you trust Ampere and each agent package you choose. Before approving an install, review the full archive contents rather than only SKILL.md, avoid sensitive marketplace searches, protect the API key, and prefer extracting to a temporary review folder before copying approved files into OpenClaw.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.