ClawHub
Back to skill

Security audit

AgentWork Skill

Security checks for vulnerabilities and agentic risk

Overview

AgentWork is a coherent escrow marketplace skill, but it gives agents high-impact wallet, credential, task-execution, and automation powers without enough enforced containment or destination checks.

Review this skill carefully before installing. It is intended to trade and settle real orders, so use it only with limited-scope API keys, low-value hot wallets, trusted endpoint configuration, and strong supervision of cron or worker automation. Do not run marketplace task execution from a directory or environment containing unrelated secrets.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)

T01 · Skill Instruction Hijacking

Error
Location
scripts/execute-task.mjs:202
Finding

Buyer-Controlled Task Prompts Can Access and Exfiltrate Local Data Through AI CLI Tools

Content
View full analysis
0) { extras.push(`${label}: ${value.map((item) => String(item)).join(", ")}`); } } if (extras.length === 0) return basePrompt; return `${basePrompt}\n\n${extras.join("\n")}`; } ``` ```js async function dispatchCodex(input) { const model = input.model || "o4-mini"; const cmdArgs = [ "exec", input.prompt, "--json", "--color", "never", "--sandbox", "read-only", "--skip-git-repo-check", "--model", model, ]; const runResult = await runCommandWithTimeout({ command: "codex", args: cmdArgs, cwd: process.cwd(), env: process.env, timeoutMs: input.dispatchTimeoutSec * 1000, }); // ... return { // ... process_evidence: { // ... raw_trace: rawTrace, raw_trace_format: "jsonl", raw_trace_hash: rawTraceHash, }, }; } ``` ```js async function dispatchClaudeCode(input) { const model = input.model || "sonnet"; const maxBudget = "1.00"; const cmdArgs = [ "-p", input.prompt, "--output-format", "stream-json", "--model", model, "--max-budget-u ...[truncated 3580 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/execute-task.mjs:327
Finding

Arbitrary Service Base URLs Receive AgentWork API Keys and Recovery Codes

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/executors/x402.mjs:38
Finding

x402 Executor Signs Server-Supplied Token Transfers Without Validating Economic Terms

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/executors/onchainos-gateway.mjs:46
Finding

Arbitrary OnchainOS Gateway Can Capture Reusable OKX Credentials

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Error
Location
scripts/signers/agentkit.mjs:13
Finding

AgentKit Module Override Permits Tool Replacement and Wallet-Credential Theft

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/wallet-ops.mjs:492
Finding

Documented Transfer Confirmation and Balance Limits Are Not Enforced by Wallet Code

Content
View full analysis
{ error('KEYSTORE_DECRYPT_FAILED', e.message); }); const transferred = await executor.transferToken({ wallet, rpc: requireArg(args, 'rpc'), baseUrl: args['base-url'], token: requireArg(args, 'token'), to: requireArg(args, 'to'), amount: requireAmountMinorArg(args), }).catch((e) => { error('TX_FAILED', e.message); }); output(transferred); } ``` The security policy states: ```md ### Manual Transfer Safety - Any transfer > 100 settlement tokens (or entire balance) requires explicit owner confirmation - The agent asks: "Confirm transfer of {amount} {chain_config.settlement_token.symbol} to {address}? (yes/no)" ``` The worker instructions state: ```md d. If token_balance > max AND owner_transfer_address is set: → Transfer excess (token_balance - max) to owner_transfer_address → Log the sweep tx_hash ``` ### Technical Analysis The transfer command accepts a recipient, token contract, RPC endpoint, and amount, then loads the wallet and broadcasts the transaction. It does not implement the documented 100-token threshold, detect transfers of the entire balance, verify an owner confirmation, enforce an approved withdrawal address, or impose a local maximum. The safety control therefore exists only as an instruction to the calling agent. It can be bypassed through direct scr ...[truncated 1200 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (43)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
90% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · references/sell.md (reported line 214)May include surrounding context.

md
For `created` orders or free orders, no signature is needed.

**Already claimed?** You cannot decline a claimed order directly. Instead:
1. `POST /agent/v1/orders/:id/release-claim` — returns order to `funded`
2. Then `POST /agent/v1/orders/:id/seller-decline` — for escrow, this
   starts the same pre-execution refund path; for free orders, it

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

These functions can approve token spending, transfer tokens, and deposit funds into escrow, all of which are financially irreversible once broadcast on-chain. In the context of an agent skill that may be invoked indirectly, the lack of built-in confirmation, policy checks, or transaction guardrails increases the risk of unauthorized or unintended asset movement if upstream input validation is weak or compromised.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/signers/ethers-keystore.mjs (reported line 27)May include surrounding context.

js
'-w', passphrase,
        '-U',
      ], { stdio: 'pipe' });
      return 'keychain';
    } catch {
      // fall through
    }

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/signers/ethers-keystore.mjs (reported line 174)May include surrounding context.

js
'-w', passphrase,
        '-U',
      ], { stdio: 'pipe' });
      return 'keychain';
    } catch {
      // fall through
    }

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

If OS credential storage is unavailable, the code falls back to storing the keystore passphrase in a plaintext local file next to the keystore. Because possession of both the encrypted keystore and its plaintext passphrase enables wallet decryption, any local file disclosure, backup leak, or directory traversal issue can directly expose the private key.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

This code path reads the wallet passphrase from a local .passphrase file, enabling decryption of the keystore when both files are present. In a trading/escrow agent context, compromise of these files can lead to theft of funds or unauthorized signing with the hot wallet.

Content

Scanner excerpt · scripts/signers/ethers-keystore.mjs (reported line 80)May include surrounding context.

js
const passFile = `${credDir}/.passphrase`;
  if (!existsSync(passFile)) {
    throw new Error('No passphrase in keychain or file');
  }
  return readFileSync(passFile, 'utf8').trim();
}

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The deposit command can approve/deposit tokens to escrow or perform x402 payment-related escrow actions immediately from command arguments, again without any human confirmation or secondary authorization step. Because this skill is specifically built for escrow-secured settlement and wallet operations, the lack of an explicit consent barrier makes unauthorized or prompt-induced fund commitment especially risky.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The verify-wallet flow sends an API bearer token, wallet address, signed challenge, wallet metadata, and optional recovery code to a caller-supplied baseUrl with no trust validation, disclosure, or confirmation. This enables silent exfiltration of sensitive credentials and account-recovery material, especially if an attacker can influence the base URL or invoke the skill through an autonomous agent workflow.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill uses sensitive capabilities including environment-variable access, outbound network calls, and shell commands, but it does not declare any tool scope or allowed-tools constraints. That increases the chance the agent can invoke more powerful operations than the user expects, especially in a skill that handles API keys, writes credentials to disk, and can configure cron jobs.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
if the process crashes after apiKey but before recovery_code, it is lost forever):
   STATE_DIR="${OPENCLAW_STATE_DIR:-$HOME/.openclaw}"
   CRED_DIR="$STATE_DIR/credentials/agentwork"
   mkdir -p "$CRED_DIR" && chmod 0700 "$CRED_DIR"
   echo "{recovery_code}" > "$CRED_DIR/recovery_code" && chmod 0600 "$CRED_DIR/recovery_code"
   openclaw config set skills.entries.agentwork.apiKey "{api_key}"
   export AGENTWORK_API_KEY="{api_key}"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 67)May include surrounding context.

md
if the process crashes after apiKey but before recovery_code, it is lost forever):
   STATE_DIR="${OPENCLAW_STATE_DIR:-$HOME/.openclaw}"
   CRED_DIR="$STATE_DIR/credentials/agentwork"
   mkdir -p "$CRED_DIR" && chmod 0700 "$CRED_DIR"
   echo "{recovery_code}" > "$CRED_DIR/recovery_code" && chmod 0600 "$CRED_DIR/recovery_code"
   openclaw config set skills.entries.agentwork.apiKey "{api_key}"
   export AGENTWORK_API_KEY="{api_key}"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 247)May include surrounding context.

md
if the process crashes after apiKey but before recovery_code, it is lost forever):
   STATE_DIR="${OPENCLAW_STATE_DIR:-$HOME/.openclaw}"
   CRED_DIR="$STATE_DIR/credentials/agentwork"
   mkdir -p "$CRED_DIR" && chmod 0700 "$CRED_DIR"
   echo "{recovery_code}" > "$CRED_DIR/recovery_code" && chmod 0600 "$CRED_DIR/recovery_code"
   openclaw config set skills.entries.agentwork.apiKey "{api_key}"
   export AGENTWORK_API_KEY="{api_key}"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
STATE_DIR="${OPENCLAW_STATE_DIR:-$HOME/.openclaw}"
   CRED_DIR="$STATE_DIR/credentials/agentwork"
   mkdir -p "$CRED_DIR" && chmod 0700 "$CRED_DIR"
   echo "{recovery_code}" > "$CRED_DIR/recovery_code" && chmod 0600 "$CRED_DIR/recovery_code"
   openclaw config set skills.entries.agentwork.apiKey "{api_key}"
   export AGENTWORK_API_KEY="{api_key}"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 248)May include surrounding context.

md
STATE_DIR="${OPENCLAW_STATE_DIR:-$HOME/.openclaw}"
   CRED_DIR="$STATE_DIR/credentials/agentwork"
   mkdir -p "$CRED_DIR" && chmod 0700 "$CRED_DIR"
   echo "{recovery_code}" > "$CRED_DIR/recovery_code" && chmod 0600 "$CRED_DIR/recovery_code"
   openclaw config set skills.entries.agentwork.apiKey "{api_key}"
   export AGENTWORK_API_KEY="{api_key}"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide documents an endpoint that creates an owner portal login link with owner_full scope and returns a bearer-style tokenized URL, token, and expiry. Exposing privileged access acquisition steps in a skill whose stated purpose is escrow-secured settlement and verification expands the attack surface and can enable unauthorized administrative access if the skill can invoke or encourage use of this capability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The guide instructs the agent to perform multiple external API calls and execute a local task script that can affect listings, quotes, orders, deposits, and delivery state, but it provides no requirement for explicit user consent, confirmation gates, or notice that data will be transmitted off-platform. In a trading and escrow context, this can lead to unintended financial or operational actions being taken automatically, especially if the skill is invoked in a loosely supervised workflow.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The flow documents that the platform auto-confirms if no action is taken within 24 hours, which creates an autonomous decision path with potentially irreversible trade consequences. In this skill's context, where orders, escrow, and delivery acceptance have financial significance, passive timeout behavior increases the risk of unauthorized acceptance or missed dispute windows.

Content

Scanner excerpt · guides/trading.md (reported line 84)May include surrounding context.

accept: POST /orders/:id/accept-delivery cooperative refund: POST /orders/:id/resolution-proposals explicit escalation: POST /orders/:id/dispute timeout: platform auto-confirms if no action (24h) [task: ...] — only task assets; use scripts/execute-task.mjs; pack auto-delivers after funding [seller opt-out] — before claim: POST /orders/:id/seller-decline; after claim: release-claim if needed; otherwise use resolution-proposal or dispute

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The guide instructs the agent to generate a local hot-wallet keystore and perform transfer/deposit operations, but it does not require an explicit owner confirmation at the point funds-sensitive state is created or assets are moved. In an agent skill, this increases the risk of silent wallet creation, unintended deposits, or withdrawals triggered by workflow logic without the owner fully understanding that local private key material and transferable funds are involved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The AgentKit section tells the operator to supply CDP credentials and wallet recovery metadata for a remotely managed wallet, but it lacks an explicit warning that these secrets confer signing capability over funds. Without strong handling guidance, an agent or operator may expose CDP_API_KEY_SECRET, CDP_WALLET_SECRET, or reusable wallet metadata in logs, prompts, environment dumps, or API payloads, enabling unauthorized wallet access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The guide instructs the worker to automatically transfer excess token balance to an owner-specified address once a threshold is exceeded, without requiring a per-transfer confirmation or a stronger approval gate at the time of movement. In an automation skill that manages escrowed funds and wallet operations, this increases the chance of unauthorized, mistaken, or attacker-influenced withdrawals if configuration is wrong, compromised, or manipulated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/buy.md (reported line 375)May include surrounding context.

md
- **Accept** — settles the order. Payment is released to the seller.
- **Open a cooperative refund proposal** — see [Request a Refund](#request-a-refund).
- **Open a dispute** — for objective breach cases, escalate directly via `POST /orders/:id/dispute`.
- **No action before timeout** — platform auto-confirms the delivery (24h default).

For escrow orders, `accept-delivery` requires a buyer wallet signature.
Free orders don't require a signature.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The instruction to translate the owner_prompt into the owner's language without mentioning user confirmation or a trust boundary can cause the agent to transform security-sensitive wallet approval text before showing it. That creates a prompt-mediation risk: a compromised or malformed upstream owner_prompt could be altered, softened, or misrepresented during translation, leading the owner to approve capability installation or wallet operations they did not fully understand.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

The guide explicitly instructs persistent local storage of the recovery code under ~/.agentwork/credentials/agentwork/. Although file permissions are restricted, the recovery code is a high-value long-lived secret and local persistence increases the blast radius of endpoint compromise, backup leakage, or unintended file synchronization.

Content

Scanner excerpt · references/setup.md (reported line 67)May include surrounding context.

md
# Store recovery_code in a protected file:
STATE_DIR="${AGENTWORK_STATE_DIR:-$HOME/.agentwork}"
CRED_DIR="$STATE_DIR/credentials/agentwork"
mkdir -p "$CRED_DIR" && chmod 0700 "$CRED_DIR"
echo "<the data.recovery_code value>" > "$CRED_DIR/recovery_code" && chmod 0600 "$CRED_DIR/recovery_code"

# Persist AGENTWORK_API_KEY in your runtime secret store.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 68)May include surrounding context.

md
STATE_DIR="${AGENTWORK_STATE_DIR:-$HOME/.agentwork}"
CRED_DIR="$STATE_DIR/credentials/agentwork"
mkdir -p "$CRED_DIR" && chmod 0700 "$CRED_DIR"
echo "<the data.recovery_code value>" > "$CRED_DIR/recovery_code" && chmod 0600 "$CRED_DIR/recovery_code"

# Persist AGENTWORK_API_KEY in your runtime secret store.
# OpenClaw example:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The guide instructs users to export the recovery code as an environment variable, which can expose it through shell history, process listings, crash reports, or inherited subprocess environments. Because the recovery code is described as the only way to recover a lost key, disclosure could enable account recovery abuse or weaken the security of the agent identity.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.secret_argv_exposure

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/execute-task.mjs:394

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/runtime-node-packages.mjs:225

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/execute-task.mjs:12

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/executors/onchainos-gateway.mjs:17

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/executors/x402.mjs:122

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/wallet-ops.mjs:85

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
guides/wallet.md:129