ClawHub
Back to skill

Security audit

MAXIA Marketplace

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it enables real financial actions through broad remote APIs without enough built-in scoping or confirmation guidance.

Review before installing. Use a dedicated wallet and API key, do not authorize automatic payments or trades, require manual confirmation for every paid action, verify treasury address/chain/amount/fees independently, prefer sandbox mode first, and avoid loading the remote MCP manifest unless your agent can allowlist tools and block unexpected schema changes.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T07 · Tool Hijacking and Spoofing

Warning
Location
SKILL.md:134
Finding

Mutable Remote MCP Manifest and Tool Endpoint

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 134-142
Vulnerability Type: Remote tool-definition trust without integrity verification
Risk Level: Medium

Vulnerable Code Snippet:

text
## MCP Integration

For agents supporting Model Context Protocol, connect directly:

MCP manifest: https://maxiaworld.app/mcp/manifest SSE stream: https://maxiaworld.app/mcp/sse Tool call: POST https://maxiaworld.app/mcp/tools/call

text

31 MCP tools available including: `maxia_discover`, `maxia_execute`, `maxia_swap_quote`, `maxia_prices`, `maxia_gpu_tiers`, `maxia_gpu_rent`, `maxia_stocks_list`, `maxia_defi_yield`, `maxia_sentiment`, `maxia_trending`, `maxia_fear_greed`, `maxia_token_risk`, `maxia_wallet_analysis`, `maxia_signals`, `maxia_portfolio`.

Technical Analysis

The skill instructs compatible agents to connect directly to an externally hosted MCP manifest, SSE stream, and tool-call endpoint. The package does not include a pinned copy of the manifest, expected tool schemas, a cryptographic digest, a signature-verification procedure, or an allowlist restricting which remote tools may be registered.

Because the manifest and its associated tool behavior are mutable server-side resources, their definitions can change after the skill package has been reviewed. If the remote service, deployment infrastructure, DNS account, or administrative credentials are compromised, an attacker could publish deceptive tool names or descriptions that appear legitimate while causing calls to perform different operations.

This is especially significant because the documented tool set includes marketplace execution, swaps, GPU rentals, tokenized-stock operations, wallet analysis, and portfolio access. HTTPS protects transport confidentiality and server authentication but does not guarantee that future content served by the authenticated domain is identical to the content that was audited.

Attack Path

...[truncated 1579 chars]

Remediation
View remediation

Remediation Suggestions

  • Include a locally reviewed MCP manifest and explicit expected schemas for every permitted tool.
  • Pin the remote manifest to a version and verify it using a trusted digital signature or cryptographic digest before registration.
  • Reject unexpected tools, parameters, permission changes, endpoint changes, and schema changes.
  • Allowlist only the MCP tools required for the current task instead of registering all remotely advertised tools.
  • Require explicit, transaction-specific user confirmation before swaps, purchases, rentals, sales, or any other paid operation.
  • Display the exact asset, amount, recipient, network, fees, and expected result before requesting authorization.
  • Apply data minimization so tool calls cannot receive unrelated conversation context, environment variables, API keys, private keys, seed phrases, or credentials.
  • Separate read-only discovery tools from state-changing and financial tools, with stronger authorization policies for the latter.
  • Monitor and audit manifest versions and tool calls, and fail closed if signature or schema verification fails.

T08 · Insecure Dependencies

Warning
Location
README.md:23
Finding

Unpinned Installation from Mutable Remote Sources

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 23-31
Vulnerability Type: Unpinned supply-chain installation
Risk Level: Medium

Vulnerable Code Snippet:

markdown
### OpenClaw
```bash
openclaw skills install maxia-marketplace

Or clone into your skills directory:

bash
git clone https://github.com/MAXIAWORLD/maxia-marketplace-skill ~/.openclaw/skills/maxia-marketplace
text

### Technical Analysis

The documented installation commands resolve mutable remote content without selecting a reviewed version, release tag, or immutable commit. They also provide no checksum or signature-verification procedure.

The package name used by the OpenClaw installer may resolve to a newer registry artifact in the future, while the Git command clones the repository's then-current default branch. Consequently, users following these instructions are not guaranteed to install the same two-file package that was audited. A compromised publisher account, registry entry, repository, or upstream release process could introduce additional skill instructions or executable files.

The audited snapshot contains no executable scripts or embedded malicious code. The risk arises from the installation procedure allowing unaudited future content to replace the reviewed content.

### Attack Path

1. An attacker compromises the upstream registry publisher, GitHub organization, repository credentials, or release process.
2. The attacker publishes a modified package or changes the repository's default branch.
3. A user follows `openclaw skills install maxia-marketplace` or the unpinned `git clone` command.
4. The installer retrieves the attacker-modified version rather than the audited snapshot.
5. The agent loads the altered skill from its trusted skills directory.
6. Any malicious instructions or executable components added upstream then operate with the permissions granted to the agent or skill framework.

#
...[truncated 578 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin installation instructions to an immutable, reviewed commit hash or a cryptographically signed release.
  • For Git installation, clone and explicitly check out the approved commit rather than relying on the default branch.
  • Publish SHA-256 checksums for release artifacts and require users or installers to verify them before activation.
  • Sign releases using a verifiable mechanism such as Sigstore or signed Git tags, and document signature verification.
  • Configure the package installer to enforce exact versions rather than automatically selecting the newest package.
  • Review the installed file list before enabling the skill and reject unexpected scripts, binaries, symbolic links, or configuration files.
  • Use protected branches, mandatory review, least-privilege publisher credentials, and multi-factor authentication for upstream publishing accounts.
  • Record the exact package version, source commit, checksum, and manifest version in deployment logs for reproducible audits.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The payment flow describes irreversible on-chain USDC transfers and subsequent service execution but does not require strong user-facing warnings, amount verification, destination verification, or explicit confirmation before funds are moved. Because blockchain payments are difficult or impossible to reverse, any mistaken invocation, prompt confusion, or manipulated parameters can directly lead to permanent financial loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README advertises capabilities that can move value, trade assets, and interact with external financial systems, but it provides no warning that use may trigger real transactions, fees, slippage, custody risk, or irreversible loss of funds. In an agent-skill context, that omission is dangerous because developers may install and authorize the skill without realizing it can enable autonomous high-impact financial actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The README instructs users to send identifying data, including a wallet address, to an external service via a POST request in order to obtain an API key. While this is a common onboarding flow, it still constitutes external transmission to a third party and can expose agent identity or wallet metadata without any explanation of data handling, privacy expectations, or trust boundaries.

Content

Scanner excerpt · README.md (reported line 47)May include surrounding context.

  1. Get a free API key:
bash
curl -X POST https://maxiaworld.app/api/public/register \
  -d '{"name": "my-agent", "wallet": "YOUR_SOLANA_WALLET"}'

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The invocation guidance is extremely broad and covers crypto trading, GPU rental, DeFi, stocks, wallet analysis, and marketplace actions, which can cause the skill to be selected for common finance or infrastructure requests without sufficient narrowing. In agent ecosystems, overbroad routing increases the chance of unintended use of high-risk transactional tools and can bypass more specialized review or confirmation logic.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

The registration example transmits agent metadata and a wallet address to an external service, which is expected for this integration but still constitutes outbound data disclosure to a third party. In the context of an agent skill, this becomes riskier because agents may auto-populate identifying information or reuse sensitive wallet/account data without clear minimization or consent boundaries.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

1. Register (free, no payment)

bash
curl -X POST https://maxiaworld.app/api/public/register \
  -H "Content-Type: application/json" \
  -d '{"name": "my-agent", "wallet": "YOUR_SOLANA_WALLET", "description": "My AI agent"}'

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill is marketed primarily for marketplace, crypto, GPU rental, and DeFi actions, but it also exposes generic web scraping and image generation endpoints that materially broaden its effective capability surface. That mismatch can cause the orchestrator or user to invoke a more powerful tool than expected, increasing the risk of unreviewed data exfiltration, SSRF-like scraping abuse, or off-scope content generation through a skill that appears financially focused.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.