UniMarket P2P Marketplace

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:13 AM UTC
• Version: 0.1.6

Overview

This marketplace skill is mostly coherent, but it handles wallet secrets in an unsafe and under-disclosed way, so users should review it carefully before installing.

Install only if you are comfortable with this skill reading your shared Unicity wallet and handling the raw private key in-process for marketplace authentication. Prefer a test wallet or sandboxed account, run dependencies from the lockfile before commands, avoid direct unpinned npx execution, and treat posted listings plus profile data as public marketplace activity. The hard-coded API key and raw private-key extraction should be fixed before broad trust.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: lib/wallet.ts:27

Finding

Hard-Coded Shared Oracle API Key

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:48

Finding

Documented npx Workflow May Download and Execute Unreviewed Package Code

Content

View full analysis

``` ``` The package is also declared using a non-exact version range in `package.json`: ```json "devDependencies": { "@types/node": "^22.0.0", "tsx": "^4.21.0", "typescript": "^5.9.3" } ``` ### Technical Analysis The documented workflow invokes `npx tsx` directly. When an appropriate local binary is unavailable, `npx` may retrieve package code from the configured npm registry and execute it. This creates a conditional remote-code execution channel whose effective payload can differ from the version reviewed with the Skill. The project includes a lockfile with registry URLs and integrity hashes, which reduces this risk when users first run `npm ci` and execute the resulting local binary. However, the instructions do not require that locked installation workflow before invoking `npx`. The manifest also permits compatible future releases through the `^4.21.0` range. This is especially sensitive because the invoked scripts initialize the Sphere SDK and read the wallet mnemonic from `~/.openclaw/unicity/mnemonic.txt`. Third-party code executed in the same Node.js process operates with the user's OS permissions and could access the same files. The audit did not find evidence that the currently locked `tsx` package is malicious. The vulnerability is the unsafe execution path that can retrieve and run a package version outside the reviewed lockfile. ### Attack Path A viable exploitation path is conditional on package or registry compromise: 1. The user follows the documented `npx tsx ...` command without first installing the lockfile-pinned dependencies. 2. No suitable local `tsx` executable is avai ...[truncated 1327 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (51)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description is about marketplace actions on UniMarket and negotiation via Nostr. This code chunk does not implement search, posting intents, discovery, negotiation, or Nostr messaging. Instead, it performs wallet management: reading a mnemonic from local storage, loading trust base configuration, initializing a Sphere wallet client, and exposing direct access to the private key via an internal field. Accessing and returning a private key is a sensitive capability not reflected in the declared purpose, making this a clear description/behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a full UniMarket P2P trading capability with offer posting, offer discovery, and Nostr-based negotiation. The supplied code chunk only fetches a list of categories from a public search endpoint and logs them. This is a narrow catalog/listing function and does not demonstrate the core declared marketplace or negotiation behaviors. Therefore, the description materially overstates what the code actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The code chunk is focused on intent lifecycle management for a marketplace: create a buy/sell intent, list intents, and close an intent. That partially matches the description's posting and discovering offers. However, the description also claims negotiation via Nostr and broader marketplace trading behavior, neither of which is implemented in this code. Instead, the script performs authenticated REST API operations using a loaded wallet/private key. Because a significant declared capability (negotiation via Nostr) is absent and the actual behavior is narrower and somewhat different, this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description centers on marketplace trading functionality, but this code chunk only fetches and displays the authenticated agent's profile. While it references a Nostr public key as part of the profile output, it does not perform offer discovery, posting intents, or negotiating deals. This is a materially different primary purpose, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code chunk is an agent registration script, not a marketplace trading/searching implementation. Its primary function is to collect a display name, derive the agent's public key from the local wallet, and register that identity with a server API. While the optional Nostr pubkey may relate to the broader system, this script does not post buy/sell intents, discover offers, or negotiate deals. The wallet/key usage and server registration are materially different from the declared purpose, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence

Finding

The supplied code only implements searching/discovery of marketplace intents. It accepts a query plus optional type/category/limit filters, calls a public search API endpoint, and displays results. There is no functionality for posting intents, executing trades, or negotiating via Nostr in this chunk. Because the declared description presents a broader trading and negotiation capability than the code actually provides, the description does not accurately represent this specific code chunk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

npx tsx scripts/register.ts --name "YourAgentName" --nostr <your-nostr-pubkey>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

npx tsx scripts/intent.ts post --type sell --desc "Offering web scraping service, any site" --category services --price 5

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

npx tsx scripts/intent.ts post --type sell --desc "Offering web scraping service, any site" --category services --price 5

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

npx tsx scripts/intent.ts post --type sell --desc "Offering web scraping service, any site" --category services --price 5

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

npx tsx scripts/intent.ts post --type sell --desc "Offering web scraping service, any site" --category services --price 5

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code deliberately bypasses the SDK's public safety boundary by reading the TypeScript-private _identity field and returning the raw privateKey. Exposing a wallet private key is highly dangerous because any downstream caller, logger, plugin action, or compromised component can exfiltrate it and fully impersonate the wallet owner, irreversibly stealing funds or signing malicious actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The function accesses and exposes the most sensitive wallet credential without any user disclosure, consent flow, or obvious functional need for a marketplace trading/search skill. In this context, silent key extraction is especially suspicious because users would reasonably expect order posting or negotiation, not raw secret export, making covert credential theft or misuse much more dangerous.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · package-lock.json (reported line 1075)May include surrounding context.

json

"@libp2p/crypto": "^5.1.7",
        "@libp2p/interface": "^3.1.0",
        "@libp2p/kad-dht": "^16.1.0",
        "@libp2p/keychain": "^6.0.5",
        "@libp2p/logger": "^6.0.5",
        "@libp2p/utils": "^7.0.5",
        "interface-datastore": "^9.0.2",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · package-lock.json (reported line 1133)May include surrounding context.

json

"@libp2p/crypto": "^5.1.7",
        "@libp2p/interface": "^3.1.0",
        "@libp2p/kad-dht": "^16.1.0",
        "@libp2p/keychain": "^6.0.5",
        "@libp2p/logger": "^6.0.5",
        "@libp2p/utils": "^7.0.5",
        "interface-datastore": "^9.0.2",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · package-lock.json (reported line 1213)May include surrounding context.

json

"@libp2p/crypto": "^5.1.7",
        "@libp2p/interface": "^3.1.0",
        "@libp2p/kad-dht": "^16.1.0",
        "@libp2p/keychain": "^6.0.5",
        "@libp2p/logger": "^6.0.5",
        "@libp2p/utils": "^7.0.5",
        "interface-datastore": "^9.0.2",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · package-lock.json (reported line 1509)May include surrounding context.

json

"@libp2p/crypto": "^5.1.7",
        "@libp2p/interface": "^3.1.0",
        "@libp2p/kad-dht": "^16.1.0",
        "@libp2p/keychain": "^6.0.5",
        "@libp2p/logger": "^6.0.5",
        "@libp2p/utils": "^7.0.5",
        "interface-datastore": "^9.0.2",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · package-lock.json (reported line 1724)May include surrounding context.

json

"@libp2p/crypto": "^5.1.7",
        "@libp2p/interface": "^3.1.0",
        "@libp2p/kad-dht": "^16.1.0",
        "@libp2p/keychain": "^6.0.5",
        "@libp2p/logger": "^6.0.5",
        "@libp2p/utils": "^7.0.5",
        "interface-datastore": "^9.0.2",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · package-lock.json (reported line 1726)May include surrounding context.

json

"@libp2p/crypto": "^5.1.7",
        "@libp2p/interface": "^3.1.0",
        "@libp2p/kad-dht": "^16.1.0",
        "@libp2p/keychain": "^6.0.5",
        "@libp2p/logger": "^6.0.5",
        "@libp2p/utils": "^7.0.5",
        "interface-datastore": "^9.0.2",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · package-lock.json (reported line 2001)May include surrounding context.

json

"@libp2p/crypto": "^5.1.7",
        "@libp2p/interface": "^3.1.0",
        "@libp2p/kad-dht": "^16.1.0",
        "@libp2p/keychain": "^6.0.5",
        "@libp2p/logger": "^6.0.5",
        "@libp2p/utils": "^7.0.5",
        "interface-datastore": "^9.0.2",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · package-lock.json (reported line 4468)May include surrounding context.

json

"@libp2p/crypto": "^5.1.7",
        "@libp2p/interface": "^3.1.0",
        "@libp2p/kad-dht": "^16.1.0",
        "@libp2p/keychain": "^6.0.5",
        "@libp2p/logger": "^6.0.5",
        "@libp2p/utils": "^7.0.5",
        "interface-datastore": "^9.0.2",

Known Vulnerable Dependency: @libp2p/kad-dht==16.1.3 — 1 advisory(ies): CVE-2026-45783 (@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion o)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The lockfile includes '@libp2p/kad-dht' version 16.1.3, which is flagged with a high-severity advisory for unvalidated PUT_VALUE records leading to unbounded disk exhaustion. In this skill's marketplace/networking context, libp2p-related optional dependencies can increase exposure to untrusted peer input, making denial-of-service against the host more plausible if the affected component is enabled.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The dependency tree contains 'ws' version 7.5.10, which is associated with a memory exhaustion DoS advisory. Because this skill negotiates and communicates over networked protocols and includes optional websocket-capable components, an attacker may be able to send crafted fragmented frames or chunks to degrade or crash the process if the vulnerable path is reachable.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The lockfile includes 'axios' 1.13.5 with multiple advisories, including SSRF-related and prototype-pollution-adjacent impacts. In a trading/marketplace skill that likely makes outbound requests and handles remote data, these issues could expose internal network resources, tamper with request behavior, or facilitate credential/response compromise if vulnerable axios features are exercised.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The presence of 'brace-expansion' 1.1.12 introduces several denial-of-service advisories related to pathological expansion behavior. While commonly triggered in tooling or pattern parsing rather than core runtime paths, it remains a real supply-chain risk if any reachable code processes attacker-influenced glob-like patterns.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.