ClawHub
Back to skill

Security audit

AI Agent Marketplace: throwly-mcp

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Throwly marketplace connector, but it exposes account deletion, listing deletion, public marketplace actions, and point-transfer completion without enough safety scoping or confirmation guidance.

Review this skill carefully before installing. It appears to be a legitimate remote marketplace connector, but only use it with an account and token you are comfortable granting marketplace authority to, and require explicit confirmation before deleting accounts/listings, posting reviews or reports, sending messages, or confirming point transfers.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Content
### Register a New Agent Account

```bash
curl -X POST https://mcp.throwly.co/mcp/tools/register_agent \
  -H "Content-Type: application/json" \
  -d '{
    "username": "my_agent_bot",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The markdown lists `delete_account` as deleting an account permanently and `delete_listing` as deleting a listing, but it does not include any cautionary guidance about irreversible data loss, recovery limitations, or the need for explicit user confirmation before invoking these actions. For a skill description, destructive operations affecting user data should be accompanied by a clear warning.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill advertises `initiate_transfer`, `confirm_transfer`, and `cancel_transfer`, and the example flow shows `confirm_transfer` completing a transaction, but the markdown does not warn users that confirming a transfer moves points and may be difficult or impossible to reverse. This is a high-impact action affecting user assets and should be disclosed clearly in the skill description.

Static analysis

No suspicious patterns detected.