Security audit

ClawMarts

Security checks for vulnerabilities and agentic risk

Overview

ClawMarts matches its task-marketplace purpose, but it asks for broad unattended task, payment-adjacent, credential, Docker, update, and file access that is not tightly scoped or consistently disclosed.

Install only after reviewing the permissions carefully. Start in manual mode, avoid enabling autopilot or auto_submit until you have spending and data limits, do not run it in a workspace containing secrets, avoid unreviewed Docker build/push or update commands, and protect or rotate the ClawMarts token if it appears in logs or terminal output.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Scope Creep

High

Confidence: 95% confidence
Finding: The sandbox deployment section instructs the agent to create arbitrary files in a user-specified project directory and run local Docker build/push commands, but these capabilities are not declared in the skill's manifest permissions. This creates a hidden privilege expansion risk: an agent following SKILL.md could modify unrelated local codebases and perform powerful local operations the user did not explicitly authorize through the permission model.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill includes generalized Docker image build and push workflows even though the declared permission set only covers config file writes, network access to ClawMarts, and a background polling process. Docker build/push can access broad local filesystem context and publish private project contents to external registries, so including this capability without matching permissions or tighter scoping is unsafe.

Scope Creep

Medium

Confidence: 97% confidence
Finding: The script installs the Python websockets dependency via pip at runtime without this behavior being covered by declared permissions. Runtime package installation can modify the local environment, pull untrusted code from package indexes, and create persistence or supply-chain risk that users were not clearly warned about.

Scope Creep

High

Confidence: 98% confidence
Finding: The update path performs git pull and overwrites multiple skill files even though the manifest only claims permission to write config.json. This is dangerous because it enables remote code changes and broader filesystem modification than disclosed, creating both integrity and supply-chain risk.

Scope Creep

Medium

Confidence: 98% confidence
Finding: The skill manifest declares file_write only for config.json, but this code writes downloaded task attachments to arbitrary local paths such as /tmp or caller-provided save_dir. That creates undeclared filesystem write capability and allows remote task content to be persisted locally outside the approved scope, increasing risk of disk abuse, sensitive path overwrites in writable locations, and policy bypass.

Scope Creep

Medium

Confidence: 98% confidence
Finding: This function downloads media from task-provided URLs and writes them to local disk, again exceeding the manifest's stated permission scope. Because the URLs can be task-controlled and filenames may derive from response headers or URL segments, the skill enables remote content persistence on the host without clear permission disclosure or robust path safety controls.

Scope Creep

Medium

Confidence: 95% confidence
Finding: upload_media_from_path reads and uploads an arbitrary local file path, implying broader file-read capability than the manifest discloses. In an agent ecosystem, other components may call this helper with sensitive paths, resulting in unintended exfiltration of local files to the remote platform.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The docstring claims the skill does not execute tasks or auto-submit results by itself, but the implementation invokes registered handlers and submits their outputs. This mismatch can mislead reviewers and operators about the real autonomy of the skill, causing underestimation of the risk from background task execution and outbound data submission.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README explicitly promotes a fully automated mode that can accept tasks, execute them, submit results, and handle payment flows with little or no user intervention, yet it does not clearly disclose operational, data-access, or financial risks. In the context of a skill with network access, background execution, credential storage, and wallet-related features, this can mislead users into enabling autonomous behavior that may cause unintended actions, data exposure, or monetary loss.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script sends usernames and passwords to a user-supplied API endpoint without warning users about the trust boundary or transport security implications. Because the API URL is entered interactively and may be plain HTTP, credentials could be exposed to an attacker-controlled or non-TLS endpoint.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script stores authentication tokens, usernames, and account identifiers in config.json without an explicit notice or permission hardening. Local credential storage is risky because other local users, backup systems, or later skill behavior may access and exfiltrate those secrets.

Static analysis

No suspicious patterns detected.