ClawHub
Back to skill

Security audit

eBay Lister

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about creating live eBay listings, but it lets an agent publish through your signed-in account without a required final approval step.

Install only if you are comfortable letting the agent operate an eBay seller session. Use draft mode by default, review the exact title, price, condition, shipping, category, photos, and description before going live, avoid configuring notifyCommand unless you fully trust the command, and clean up local debug screenshots/logs if they may contain account or listing details.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:13 and SKILL.md:64
Vulnerability Type: Supply-chain risk caused by unpinned dependency installation
Risk Level: Medium

Vulnerable Code

SKILL.md:13:

yaml
metadata: {"openclaw": {"emoji": "🏷️", "homepage": "https://github.com/NelsonScott/ebay-lister", "requires": {"bins": ["node"]}, "install": [{"kind": "node", "package": "playwright-core"}]}}

SKILL.md:64:

bash
pip install pillow-heif

Technical Analysis

The Skill metadata requests installation of playwright-core without specifying an exact version. The optional HEIC-processing workflow similarly instructs the Agent to install the latest available pillow-heif package without a version constraint or package hash.

Although the committed npm lockfile currently resolves playwright-core version 1.61.0 from the official npm registry with SHA-512 integrity metadata, an installation performed directly from the Skill metadata may not necessarily enforce that lockfile. The Python installation has no corresponding lockfile or integrity requirement.

Package installation can execute package-controlled installation logic and makes third-party code available within the Agent's process environment. Consequently, the effective installed code may differ from the version reviewed during this audit.

This is a supply-chain weakness rather than evidence that either named package is currently malicious.

Attack Path

  1. An attacker compromises an upstream package release, maintainer account, or package-distribution channel.
  2. A user installs the Skill through metadata that requests the unversioned playwright-core package, or submits a HEIC image that causes the Agent to follow the documented pip install pillow-heif instruction.
  3. The package manager resolves the currently published version rather than a specifically reviewed artifact.
  4. The compromised package is installed an ...[truncated 920 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every dependency to an exact reviewed version:

    yaml
    "install": [{"kind": "node", "package": "playwright-core@1.61.0"}]

  2. Replace the ad hoc Python installation instruction with a committed requirements file containing hashes:

    text
    pillow-heif==REVIEWED_VERSION \
  --hash=sha256:REVIEWED_DISTRIBUTION_HASH

  3. Install Python dependencies with hash enforcement:

    bash
    python -m pip install --require-hashes -r requirements.txt

  4. Require installation through the committed npm lockfile, preferably using:

    bash
    npm ci --ignore-scripts

    If lifecycle scripts are required, review them before removing --ignore-scripts.

  5. Keep the version in package.json, the lockfile, and Skill metadata synchronized. The audited files currently contain inconsistent project versions (1.1.0 in package.json and 1.0.0 in the lockfile).

  6. Perform dependency vulnerability and provenance checks in CI, and review dependency updates before merging them.

T09 · Insecure Skill Coding Practices

Note
Location
list.js:522
Finding

Authenticated Browser Screenshots Persisted to a Predictable Path

Content
View full analysis

Vulnerability Details

File Location: list.js:522-525
Vulnerability Type: Insecure storage of potentially sensitive browser content
Risk Level: Low

Vulnerable Code

javascript
async function stuckReport(page, step) {
  const url = page.url();
  const shot = path.join(SKILL_DIR, 'debug-stuck.png');
  try { await page.screenshot({ path: shot }); } catch {}

Technical Analysis

When the eBay workflow becomes stuck, stuckReport unconditionally captures the current authenticated browser page and stores it as debug-stuck.png in the project directory. Unlike the general snap helper, this capture is not restricted to explicit debug mode.

The file uses a fixed, predictable path and is not deleted after reporting. The implementation also does not explicitly create the file with restrictive permissions or redact sensitive page regions.

Because the page belongs to an authenticated eBay session, the screenshot may contain listing details, item photographs, seller-facing account information, draft identifiers, validation messages, or other information visible in the browser. Whether another local principal can read the screenshot depends on directory permissions and the process umask, but the code does not enforce confidentiality.

Attack Path

  1. A listing operation reaches an unsupported category, condition, product-match, draft-resume, or form state.
  2. The workflow invokes stuckReport.
  3. The current authenticated page is written to the predictable path debug-stuck.png.
  4. The screenshot remains on disk after the process exits and may be overwritten only by a later stuck run.
  5. A local process, backup service, workspace collector, or other principal with access to the project directory reads or exports the retained image.

No remote exfiltration of this screenshot was found in the audited code; exploitation requires access to the local workspace or a service that collects its conten ...[truncated 618 chars]

Remediation
View remediation

Remediation Suggestions

  1. Generate stuck-state screenshots only when the user explicitly enables --debug.
  2. Store diagnostics in a private temporary directory created with mode 0700.
  3. Create screenshot files with owner-only access and verify that the resulting mode is 0600.
  4. Use randomized filenames rather than a predictable project-root path.
  5. Delete screenshots automatically after they have served their diagnostic purpose, or provide an explicit retention option.
  6. Redact account details, addresses, identifiers, and other sensitive page regions before writing a screenshot.
  7. Document that debug artifacts may contain authenticated account information and must not be attached to public issue reports without review.
  8. Return structured DOM diagnostics by default and reserve screenshots for cases where those diagnostics are insufficient.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (27)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
form-filling is `list.js`, which drives an already-logged-in Chrome over CDP.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
form-filling is `list.js`, which drives an already-logged-in Chrome over CDP.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
form-filling is `list.js`, which drives an already-logged-in Chrome over CDP.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md
form-filling is `list.js`, which drives an already-logged-in Chrome over CDP.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md
form-filling is `list.js`, which drives an already-logged-in Chrome over CDP.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md
form-filling is `list.js`, which drives an already-logged-in Chrome over CDP.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md
form-filling is `list.js`, which drives an already-logged-in Chrome over CDP.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md
form-filling is `list.js`, which drives an already-logged-in Chrome over CDP.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md
form-filling is `list.js`, which drives an already-logged-in Chrome over CDP.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md
form-filling is `list.js`, which drives an already-logged-in Chrome over CDP.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

md
form-filling is `list.js`, which drives an already-logged-in Chrome over CDP.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

md
form-filling is `list.js`, which drives an already-logged-in Chrome over CDP.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md
form-filling is `list.js`, which drives an already-logged-in Chrome over CDP.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

md
form-filling is `list.js`, which drives an already-logged-in Chrome over CDP.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.

md
form-filling is `list.js`, which drives an already-logged-in Chrome over CDP.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.

md
- `SKILL.md` — this file (the brain + workflow).

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README repeatedly emphasizes that the tool can publish listings 'for real' and 'all the way to a live listing' but does not prominently warn users to review title, price, condition, shipping, and other listing details before publication. Because the skill automates actions in a logged-in browser session tied to a real marketplace account, inaccurate model-generated content can create unintended live listings, financial loss, policy violations, or reputational damage.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill invokes browser automation, network access, local file handling, and potentially notification commands, but it declares no explicit tool scope or permission boundaries. That makes the skill over-privileged by default and increases the chance an agent can use capabilities beyond what the user expects when handling photos, drafts, or logged-in browser state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The workflow directs the agent to run the publish path and click 'List it' to create a live eBay listing, which is an irreversible external action with financial and reputational consequences. Although the skill discusses triggers like '/sell' and drafting on some failures, it does not require a fresh, explicit confirmation immediately before publication after the final title, price, condition, shipping, and photos are assembled.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The configuration explicitly supports running an arbitrary shell command after publish/draft/block events via notifyCommand. Because this skill already operates in a high-trust local environment with an authenticated browser session, adding shell execution creates an unnecessary command-execution surface that is unrelated to core listing automation and could be abused if the config or inputs influencing the command are modified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This manifest-style JSON documents that the 'longest keyword found in categoryQuery/title wins' when no categoryId is provided. The trigger scope is broad and underspecified because it does not define matching boundaries, exclusions, or negative examples, so ordinary words in a title could unintentionally activate a category mapping.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The header comment states the script saves a draft, but the implementation supports --mode publish and can create a live listing. In an agent skill that drives a logged-in browser, misleading documentation can cause unsafe invocation or user misunderstanding, leading to unintended publication of listings under the user's account.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The notifier hook executes a fully configurable shell command with shell: true and passes listing data through stdin and environment variables. If an attacker can influence ebay-lister.config.json, installation defaults, or the command string, this becomes arbitrary command execution in the user's context; the skill's eBay automation context increases sensitivity because item titles and status data may also be exfiltrated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Debug mode writes page screenshots to disk, which can expose sensitive listing and account data if debug is enabled without the operator understanding the privacy implications. This is less severe than the unconditional stuck-path screenshot because it is gated by --debug, but it still creates local sensitive artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

On stuck flows, the script unconditionally saves a screenshot of the current eBay page to local disk. Those screenshots may capture account information, addresses, listing details, and other sensitive page contents, and the skill does not provide a clear runtime warning or retention control before writing them.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.install_untrusted_source

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
list.js:143

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
list.js:75

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
ebay-lister.config.example.json:4