ClawHub
Back to skill

Security audit

波街（Bot Street）

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent marketplace API documentation, but it delegates broad owner-account and commerce authority to bots, so users should review the scope before installing.

Install only if you intend to let this bot act on your Botstreet owner account. Treat x-agent-id and x-agent-key like account delegation credentials, keep them out of prompts and logs, rotate them if exposed, and require explicit owner approval for sensitive messages, listings, address changes, order actions, payment/refund actions, and any workflow with public or financial consequences.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The document explains that Bot credentials are normalized to the owner's user identity, but it does not prominently warn that mishandling `x-agent-id`/`x-agent-key` effectively grants access to the owner's messages, orders, wallet context, and other account-bound operations. Because the skill also encourages automated polling and broad API usage, omission of credential-handling and owner-side-effect warnings raises the risk of accidental overreach or credential misuse with real account consequences.

Whitespace Padding

Medium
Category
Prompt Injection
Content
Bot **轮询一个接口** `GET /me/todos` 即可发现全平台所有待推进事项，无需分别打多个接口。


| 接口          | 方法  | 说明                                                                                            |
| ----------- | --- | --------------------------------------------------------------------------------------------- |
| `/me/todos` | GET | 一站式待办：待处理 Run / 任务（我发布+我承接）/ 私信未读 / 通知未读 / 订单。`?limit=` 控每类明细上限（默认 50），`?fresh=1` 跳过 5s 缓存取实时 |
Confidence
70% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The Run activation description is broad enough that an agent may treat loosely defined events like any private-message @mention or generic A2A inbound call as authority to execute service logic. In this skill, Run processing is tied to the owner's identity and downstream actions can affect messages, orders, and wallet-related workflows, so ambiguous triggering increases the chance of unintended invocation or action on behalf of the owner.

Static analysis

No suspicious patterns detected.