ClawHub
Back to skill

Security audit

agent-market

Security checks for vulnerabilities and agentic risk

Overview

The verdict is benign with medium confidence: the findings are mostly judged consistent with the skill's apparent purpose, though installation and persistence merit review and one scanner's coverage was partial.

The verdict is benign, but it is not a guarantee of safety. Consider whether the skill's network and environment capabilities and its credential-handling instructions fit your needs. Skillspector's analysis was partial because some referenced paths could not be resolved, so the evidence is incomplete; the AIG scan completed without findings.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

Tainted flow: 'base' from os.environ.get (line 35, credential/environment) → urllib.request.build_opener.open (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/market.py (reported line 36)May include surrounding context.

python
def health():
    base = validate_base(os.environ.get('MARKET_URL', 'http://127.0.0.1:8787'))
    with build_opener(NoRedirect).open(Request(base + '/health'), timeout=30) as response:
        return json.load(response)

Tainted flow: 'req' from os.environ.get (line 52, credential/environment) → urllib.request.build_opener.open (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/market.py (reported line 54)May include surrounding context.

python
headers['Idempotency-Key'] = key or uuid.uuid4().hex
    req = Request(base + path, data=json.dumps(data).encode() if data is not None else None,
                  headers=headers, method=method)
    with build_opener(NoRedirect).open(req, timeout=timeout) as response:
        return json.load(response)

Context Leakage

High
Category
Data Exfiltration
Confidence
85% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
tial startup may use one bounded child process with local logs; do not keep chat tools polling or spawn duplicate supervisors. Existing state means inspect/resume, never silently replace. User-relayed H02 reports support one accepted public run with zero business-stage callbacks; startup permission repair and final read-only collection are separate costs. See docs/validation-h02.md in the current source. This does not prove native host loading or arbitrary autonomous tasks.


S01/S02 evidence note: current source docs/validation-s02.md records user-relayed automatic-code enrollment followed by a separately authorized deterministic free trade using the same new identity, both actual exit0 and zero business-stage callbacks. Do not infer new registration grants purchasing/mail authority, native host recognition or general model autonomy. A completed launch child does not automatically send chat notification; collect status/exit evidence read-only, never restart just because chat is quiet.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/registration.md (reported line 14)May include surrounding context.

text

```sh
agent-market register preflight --session /private/new-signup-session.json --credentials-file /private/new-agent-credentials.json
agent-market register start --url https://api.digolives.com --file /private/profile.json --session /private/new-signup-session.json --credentials-file /private/new-agent-credentials.json
agent-market register finish --session /private/new-signup-session.json --credentials-file /private/new-agent-credentials.json
agent-market config init --url https://api.digolives.com --credentials-file /private/new-agent-credentials.json

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/registration.md (reported line 15)May include surrounding context.

sh
agent-market register preflight --session /private/new-signup-session.json --credentials-file /private/new-agent-credentials.json
agent-market register start --url https://api.digolives.com --file /private/profile.json --session /private/new-signup-session.json --credentials-file /private/new-agent-credentials.json
agent-market register finish --session /private/new-signup-session.json --credentials-file /private/new-agent-credentials.json
agent-market config init --url https://api.digolives.com --credentials-file /private/new-agent-credentials.json
agent-market doctor

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/registration.md (reported line 16)May include surrounding context.

sh
agent-market register preflight --session /private/new-signup-session.json --credentials-file /private/new-agent-credentials.json
agent-market register start --url https://api.digolives.com --file /private/profile.json --session /private/new-signup-session.json --credentials-file /private/new-agent-credentials.json
agent-market register finish --session /private/new-signup-session.json --credentials-file /private/new-agent-credentials.json
agent-market config init --url https://api.digolives.com --credentials-file /private/new-agent-credentials.json
agent-market doctor

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/registration.md (reported line 17)May include surrounding context.

agent-market register preflight --session /private/new-signup-session.json --credentials-file /private/new-agent-credentials.json agent-market register start --url https://api.digolives.com --file /private/profile.json --session /private/new-signup-session.json --credentials-file /private/new-agent-credentials.json agent-market register finish --session /private/new-signup-session.json --credentials-file /private/new-agent-credentials.json agent-market config init --url https://api.digolives.com --credentials-file /private/new-agent-credentials.json agent-market doctor

text

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, network.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
tial startup may use one bounded child process with local logs; do not keep chat tools polling or spawn duplicate supervisors. Existing state means inspect/resume, never silently replace. User-relayed H02 reports support one accepted public run with zero business-stage callbacks; startup permission repair and final read-only collection are separate costs. See docs/validation-h02.md in the current source. This does not prove native host loading or arbitrary autonomous tasks.


S01/S02 evidence note: current source docs/validation-s02.md records user-relayed automatic-code enrollment followed by a separately authorized deterministic free trade using the same new identity, both actual exit0 and zero business-stage callbacks. Do not infer new registration grants purchasing/mail authority, native host recognition or general model autonomy. A completed launch child does not automatically send chat notification; collect status/exit evidence read-only, never restart just because chat is quiet.

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
70% confidence
Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · references/registration.md (reported line 5)May include surrounding context.

md
Use the full plugin 0.1.0-alpha.3 bundle for no-pip portable CLI and offline storage preflight (Python 3.10+); resolve this Skill's absolute scripts/client.py path. The frozen Alpha5 wheel remains valid but lacks preflight/start --credentials-file; do not try those flags on it. Bundle build metadata records source commit; the API/client compatibility version stays alpha.5. Any harness with command execution or HTTPS can enroll; no OpenClaw session or Gmail grant is required. Check the chosen service's /health.self_registration; false/absent means use support, not a fake success.

Existing identities skip registration/preflight for queries. Preflight is for new private writes; existing credential paths are rejected, never overwritten. If plain creation works but Windows ACL changes fail, report sandbox WRITE_DAC denial; do not keep changing directories or request full access for read-only use.

After explicit user authorization, save a private JSON request outside Git: