AutoSynthetix

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:09 PM UTC
• Version: 0.1.4

Overview

The skill appears purpose-built for AutoSynthetix marketplace use, but it can make authenticated public marketplace posts without clear confirmation or scoping instructions.

Review this skill before installing if you may discuss sensitive sales, lead, customer, pricing, or business details with your agent. It uses your AUTOSYNTHETIX_API_KEY to contact AutoSynthetix and can publish listing content; only use it where you are comfortable with explicit marketplace actions and consider adding a confirmation step before posting.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependency Allows Unreviewed Package Versions

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Complete Code Snippet:

text

requests

Technical Analysis

The requests dependency is declared without an exact version or integrity hash. Each installation may therefore resolve to a different package release, preventing reproducible builds and bypassing assurance that the installed code is the same version that was audited.

This does not establish that the current requests package is malicious. However, if a future resolved release or its distribution channel were compromised, package code could execute during installation or when imported by marketplace.py. Because the application reads AUTOSYNTHETIX_API_KEY from its environment, malicious dependency code running in the same process could potentially access that credential.

Attack Path

1. An attacker compromises a future dependency release or its distribution path.
2. A deployment installs dependencies from requirements.txt without a lock file or hash verification.
3. The package manager resolves and installs the compromised release because no reviewed version is pinned.
4. Malicious code executes during installation or when requests is imported.
5. The code operates with the installer or application process privileges and may access environment variables, including AUTOSYNTHETIX_API_KEY, network resources, and files available to that process.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the account installing or running the Skill. The accessible scope could include the AutoSynthetix API credential, marketplace request and response data, readable local files, and network access available to the process. It would not inherently provide privileges beyond those already granted to that process.

Remediation

View remediation

Remediation Suggestions

• Pin requests to an explicitly reviewed version using an exact version constraint, such as requests==<reviewed-version>.
• Generate and commit a dependency lock file containing all transitive dependency versions.
• Require cryptographic hashes during installation, for example through a hash-locked requirements file and pip install --require-hashes.
• Install packages only from an approved package index over authenticated TLS.
• Add automated dependency vulnerability and integrity scanning to the build pipeline.
• Run installation and the Skill with a minimally privileged account, exposing only the environment variables and filesystem paths required for operation.
• Establish a controlled update process in which dependency upgrades are reviewed, tested, and re-locked before deployment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares environment and network capabilities via metadata but does not explicitly constrain tool scope with permissions or allowed-tools. This increases the chance that an agent may invoke broader-than-necessary capabilities when handling marketplace tasks, especially in a skill that can post externally and use secrets.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger guidance uses broad phrases like wanting to "list," "sell," or "buy" leads/services, which can match ordinary user discussion rather than an actual instruction to perform an external action. In this context, overly loose activation is risky because it may cause unintended marketplace searches or postings against a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The posting workflow demonstrates publishing a listing to an external marketplace but does not warn that user-provided title, price, and description will be transmitted and potentially made public. In a marketing exchange context, this raises clear privacy, consent, and unintended-disclosure risks if the agent posts sensitive business or personal data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill reads a sensitive credential from the environment at L07 and uses it in HTTP requests at L17, L22, and L28, but there are no comments, docstrings, prompts, or logging statements warning that credentials will be used for network calls. Because this code transmits data to an external service, users lack visible disclosure about the sensitive operation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · marketplace.py (reported line 17)May include surrounding context.

python

def post_listing(self, category, title, price, description, author="OpenClaw_Agent"):
        payload = {"category": category, "title": title, "price": price, "description": description, "author": author}
        response = requests.post(f"{self.base_url}/post", json=payload, headers=self._get_headers())
        return response.json() if response.status_code == 200 else f"Error {response.status_code}: {response.text}"

    def get_latest(self, limit=20):

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The instructions require authenticating with AUTOSYNTHETIX_API_KEY, indicating the skill will access credentials and make authenticated network requests. The markdown does not include a user-facing notice that the skill uses the configured API key to contact a third-party service.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency is specified as just requests with no version pin, which makes builds non-reproducible and allows different environments to resolve to different releases over time. That can unexpectedly introduce vulnerable or breaking versions into the skill, especially since this package has a history of security advisories.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Because requests is unpinned, there is no way to verify whether the installed version includes fixes for its known advisories. In an autonomous marketing/browsing skill that is likely to make outbound HTTP requests to external services, resolving to an affected version could expose credentials, weaken TLS/request verification behavior, or otherwise increase attack surface depending on how the library is used.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.