Mirage Marketplace Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:03 AM UTC
• Version: 1.0.13

Overview

This appears to be a real marketplace-bidding skill, but it combines credentialed automation, bid submission, custom providers, local executors, and weak local control files in ways users should review carefully before installing.

Review this before installing on any machine with valuable credentials. Avoid custom provider endpoints and local generator scripts unless you fully trust them, disable preset auto-accept if you want per-job control, secure ~/.openclaw/marketplace.env with user-only permissions, and prefer a version that fixes the /tmp signaling, confirmation timeout, provider URL validation, and credential scoping issues.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/provider-engine.js:110

Finding

Custom Provider Configuration Can Exfiltrate Arbitrary Environment Secrets

Content

View full analysis

", "envKey": "", "endpoint": "", "provider": { "auth": "Bearer {{apiKey}}", "body": { "prompt": "{{prompt}}" }, "response": { "type": "json", "imagePath": "data[0].url" } } } ``` ### Technical Analysis The implementation treats `capability.envKey` as an unrestricted lookup into `process.env` and sends the resulting value to `provider.endpoint`. Neither the environment-variable name nor the destination is constrained. Because `scripts/lib/env.js` imports every value from `~/.openclaw/marketplace.env`, a custom capability can select any loaded marketplace or provider secret. It can also select unrelated secrets already present in the parent process environment. The endpoint has no HTTPS requiremen ...[truncated 1275 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/provider-engine.js:169

Finding

Unvalidated Provider Response URLs Enable SSRF and Resource Exhaustion

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/approve.js:198

Finding

Local Generation Executors Inherit All Marketplace and Provider Credentials

Content

View full analysis

{ const trimmed = line.trim(); if (!trimmed || trimmed.startsWith('#')) return; const idx = trimmed.indexOf('='); if (idx === -1) return; const key = trimmed.slice(0, idx).trim(); const val = trimmed.slice(idx + 1).trim().replace(/^["']|["']$/g, ''); if (key && !(key in process.env)) process.env[key] = val; }); } ``` The configured local executor is then started without a restricted environment: ```js if (typeof capability === 'string') { const executorPath = capability.replace(/^~/, os.homedir()); if (!fs.existsSync(executorPath)) { notify('MARKETPLACE_ERROR', { jobId, message: `❌ Executor not found: ${executorPath}` }); cleanup(); process.exit(1); } const defaultExt = jobType === 'video' ? '.mp4' : '.png'; const resultPath = resultBase + defaultExt; const { spawnSync } = require('child_process'); const result = spawnSync(executorPath, [resultPath, specPath], { encoding: 'utf-8', timeout: 15 * 60 * 1000 }); ``` The listener also passes its complete environment to `approve.js`: ```js const child = spawn('node', [ path.join(SKILL_DIR, 'scripts/approve.js'), jobId, '--from-daemon', ...((isParallel || isPreset) ? ['--quiet'] : []) ], { env: { ...process.env }, stdio: ['ignore', 'pipe', 'pipe'] }); ``` ### Technical Analysis Child processes inherit the parent environment by default when the `env` option is omitted. Consequently, every configured local generator receives all credentials loaded from ...[truncated 1431 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/approve.js:32

Finding

Predictable Shared Temporary Files Permit Bid Workflow Manipulation

Content

View full analysis

'); process.exit(1); } if (!fromDaemon) { try { fs.writeFileSync(`/tmp/bid_intent_req_${jobId}`, jobId); } catch (_) {} } ``` ```js const specPath = `/tmp/job_spec_${jobId}.json`; const resultBase = `/tmp/result_${jobId}`; const protectionPath = `/tmp/protection_${jobId}.txt`; const pricePath = `/tmp/price_${jobId}.txt`; ``` Protection and price values are consumed from shared files: ```js while (Date.now() < protectionDeadline) { if (fs.existsSync(protectionPath)) break; await new Promise(r => setTimeout(r, 2000)); } if (fs.existsSync(protectionPath)) { protection = fs.readFileSync(protectionPath, 'utf-8').trim(); fs.unlinkSync(protectionPath); } ``` ```js while (Date.now() < priceDeadline) { if (fs.existsSync(pricePath)) break; await new Promise(r => setTimeout(r, 2000)); } if (fs.existsSync(pricePath)) { const raw = parseInt(fs.readFileSync(pricePath, 'utf-8').trim(), 10); if (Number.isInteger(raw) && raw >= MIN_BID && raw <= budget) { bidPrice = raw; } fs.unlinkSync(pricePath); } ``` Final confirmation also uses a predictable file and fails open on timeout: ```js const confirmPath = `/tmp/confirm_${jobId}.txt`; // ... const confirmDeadline = Date.now() + 5 * 60 * 1000; while (Date.now() < confirmDeadline) { if (fs.existsSync(confirmPath)) break; await new Promise(r => setTimeout(r, 2000)); } let confirmed = true; // default: submit if timeout ...[truncated 2571 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:236

Finding

API Credentials Are Stored in Plaintext Without Enforced Restrictive Permissions

Content

View full analysis

" > ~/.openclaw/marketplace.env ``` The same file is documented as holding several reusable credentials: ```bash MARKETPLACE_API_KEY=mrg_... # One of the following depending on chosen image API: OPENAI_API_KEY=sk-proj-... # for GPT Image 1.5 XAI_API_KEY=xai-... # for Grok Imagine FAL_KEY=... # for fal.ai models HF_API_KEY=hf_... # for HuggingFace Inference ``` ### Technical Analysis The setup procedure stores long-lived marketplace and cloud-provider credentials in `~/.openclaw/marketplace.env`. It does not first create the containing directory with mode `0700`, create the credential file with mode `0600`, or validate the file's owner and permissions when loading it. The actual permissions therefore depend on the user's current umask and pre-existing filesystem state. On a multi-user machine or permissively configured environment, the file may be readable by other users or processes. Rewriting with shell redirection also does not provide atomic replacement or symbolic-link protection. Plaintext storage may be necessary when no secret manager is available, but restrictive access controls are the minimum privilege required for such storage. ### Attack Path 1. The user follows the documented onboarding procedure under a permissive umask or with an unsafe pre-existing path. 2. The shell creates `marketplace.env` with permissions that permit access beyond the inte ...[truncated 664 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (67)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 122)May include surrounding context.

Or manually:

bash

rm ~/.openclaw/marketplace-config.json
rm -f ~/.openclaw/marketplace.env
rm -f /tmp/marketplace_pending.json /tmp/marketplace_completed.json

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 123)May include surrounding context.

Or manually:

bash

rm ~/.openclaw/marketplace-config.json
rm -f ~/.openclaw/marketplace.env
rm -f /tmp/marketplace_pending.json /tmp/marketplace_completed.json

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

Or manually:

bash

rm ~/.openclaw/marketplace-config.json
rm -f ~/.openclaw/marketplace.env
rm -f /tmp/marketplace_pending.json /tmp/marketplace_completed.json

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 124)May include surrounding context.

bash

rm ~/.openclaw/marketplace-config.json
rm -f ~/.openclaw/marketplace.env
rm -f /tmp/marketplace_pending.json /tmp/marketplace_completed.json

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

bash

rm ~/.openclaw/marketplace-config.json
rm -f ~/.openclaw/marketplace.env
rm -f /tmp/marketplace_pending.json /tmp/marketplace_completed.json

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.

bash

rm ~/.openclaw/marketplace-config.json
rm -f ~/.openclaw/marketplace.env
rm -f /tmp/marketplace_pending.json /tmp/marketplace_completed.json

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

bash

rm ~/.openclaw/marketplace-config.json
rm -f ~/.openclaw/marketplace.env
rm -f /tmp/marketplace_pending.json /tmp/marketplace_completed.json

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

bash

     rm -f ~/.openclaw/marketplace.env
     rm -f /tmp/marketplace_pending.json
     rm -f /tmp/marketplace_completed.json
     ```
     Then send intro message and wait for API key (see "First Install" case below)
   - **Present, no agentId** → Run `node scripts/register.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.

md

`node scripts/approve.js <jobId> [--quiet] [--from-daemon]`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 302)May include surrounding context.

md

`node scripts/approve.js <jobId> [--quiet] [--from-daemon]`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 484)May include surrounding context.

md

`node scripts/approve.js <jobId> [--quiet] [--from-daemon]`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

1. Reset existing files:

   bash

   rm -f ~/.openclaw/marketplace-config.json ~/.openclaw/marketplace.env
   rm -f /tmp/marketplace_pending.json /tmp/marketplace_completed.json
   

2. Save key to env file:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 485)May include surrounding context.

md

| `scripts/bid.js` | Image/video upload + bid API call |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 491)May include surrounding context.

md

| `scripts/provider-engine.js` | API calls based on providers.json |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 493)May include surrounding context.

md

| `scripts/lib/format.js` | Formatting helpers (credits, no-show rate) |

Known Vulnerable Dependency: socket.io-parser==4.2.5 — 2 advisory(ies): CVE-2026-69185 (Socket.IO: Zero-attachment Memory Exhaustion); CVE-2026-33151 (socket.io allows an unbounded number of binary attachments)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The lockfile pins socket.io-parser to 4.2.5, and the cited advisories describe denial-of-service conditions caused by unbounded or zero-attachment handling. In this skill, socket.io-client is used for marketplace connectivity, so a malicious or compromised server, relay, or man-in-the-middle endpoint could send crafted packets that trigger excessive memory consumption in the client process.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The lockfile includes ws 8.18.3, which is flagged for memory exhaustion and possible memory disclosure issues. Because this skill maintains websocket connectivity to a remote marketplace service, malformed fragmented frames from an attacker-controlled or compromised websocket peer could crash the agent or potentially expose process memory, making the networked context materially relevant.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The command deletes the local marketplace configuration file, which can erase onboarding state and force reconfiguration. In an agent ecosystem, documented shell commands can be copied or invoked with limited user scrutiny, so destructive file operations are risky when not strongly gated and explained.

Content

Scanner excerpt · references/misc.md (reported line 86)May include surrounding context.

Reset / Re-onboard

bash

rm ~/.openclaw/marketplace-config.json
rm -f /tmp/marketplace_pending.json
rm -f /tmp/marketplace_completed.json
rm -f /tmp/protection_*.txt /tmp/price_*.txt

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

This command deletes a temporary pending-job state file. Although the target is limited to a specific file, accidental execution can still disrupt job processing or lose local task state.

Content

Scanner excerpt · references/misc.md (reported line 87)May include surrounding context.

bash

rm ~/.openclaw/marketplace-config.json
rm -f /tmp/marketplace_pending.json
rm -f /tmp/marketplace_completed.json
rm -f /tmp/protection_*.txt /tmp/price_*.txt
# Restart the gateway — onboarding will start automatically

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

This removes the local completed-job tracking file, which may erase bookkeeping needed for idempotency or history. While the scope is narrow, direct deletion commands in docs can still cause avoidable operational issues if copied blindly.

Content

Scanner excerpt · references/misc.md (reported line 88)May include surrounding context.

bash

rm ~/.openclaw/marketplace-config.json
rm -f /tmp/marketplace_pending.json
rm -f /tmp/marketplace_completed.json
rm -f /tmp/protection_*.txt /tmp/price_*.txt
# Restart the gateway — onboarding will start automatically

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

This wildcard deletion removes multiple temporary control files under /tmp, which can alter approval, protection, or pricing flow and may affect in-flight operations. Wildcard-based shell deletion is more error-prone and, in an agent setting, can be propagated into unsafe automated behavior if treated as a normal recovery action.

Content

Scanner excerpt · references/misc.md (reported line 89)May include surrounding context.

rm ~/.openclaw/marketplace-config.json rm -f /tmp/marketplace_pending.json rm -f /tmp/marketplace_completed.json rm -f /tmp/protection_.txt /tmp/price_.txt

Restart the gateway — onboarding will start automatically

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

This command deletes the environment file containing the marketplace API key, creating both credential loss and possible service disruption. In this skill, the API key is central to operation, so documentation that includes direct credential-file deletion without prominent safeguards is more dangerous than in a generic context.

Content

Scanner excerpt · references/misc.md (reported line 95)May include surrounding context.

md

This does NOT delete `~/.openclaw/marketplace.env`. The API key is preserved.

For a full reset including the API key: also run `rm ~/.openclaw/marketplace.env`.

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The skill includes a direct shell deletion command against local files, which is a tool-parameter abuse pattern because it performs destructive filesystem action from workflow logic. Even though the paths are fixed and not obviously user-injected, the command is still dangerous because it bypasses safer application-level state reset handling and can silently destroy local operational data.

Content

Scanner excerpt · references/onboarding.md (reported line 327)May include surrounding context.

md

- **yes** → start listener normally (catch-up runs automatically on connect)
   - **no** → clear pending/completed files before starting:
     ```bash
     rm -f /tmp/marketplace_pending.json /tmp/marketplace_completed.json
     ```
4. `node scripts/listen.js` — Start WebSocket listener. **This is a long-running daemon. Run it in the background (do NOT await/block on it).** It sends messages to Telegram on its own via messaging.js. After starting it, immediately return control to the user — do NOT wait for it to finish.
5. listen.js automatically prints the **welcome message** on first start. No need to send the command list manually.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README instructs users to paste a marketplace API key during onboarding but does not warn that this is a sensitive credential or advise against sharing it in insecure contexts. In an agent/chat-driven workflow, users may paste secrets into logs, chat history, screenshots, or sessions visible to plugins and operators, increasing credential exposure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README provides manual deletion commands to reset the skill but does not clearly warn that these commands remove local configuration, environment data, and pending/completed marketplace state. This can cause accidental data loss and disrupt operation, especially for non-technical users copying commands verbatim.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/approve.js:206

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/bid.js:80

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/config-handler.js:28

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/lib/messaging.js:20

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/listen.js:248

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/provider-engine.js:110