Security audit

Lucky Gumroad Automation

Security checks for vulnerabilities and agentic risk

Overview

This skill is not overtly malicious, but it uses a persistent logged-in Gumroad seller browser profile with broad store-management authority and insecure browser handling.

Install only if you intend this agent to operate the qcautonomous/RayChod Gumroad seller account. Require explicit approval for sales/customer data access, product publishing, uploads, and profile changes; protect the Chrome profile like a password; remove or restrict remote debugging; avoid --no-sandbox where possible; and replace the fixed /tmp dump with a secure temporary file that is deleted after use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:26
Finding: Authenticated Chrome Sessions Run Without Browser Sandbox Protection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:26
Finding: Authenticated Dashboard Data Is Written to a Predictable Shared Temporary File
Content: View full analysis
/tmp/gumroad-test.html 2>/dev/null grep -E "Dashboard/Index|logged_in_user|current_seller" /tmp/gumroad-test.html | head ``` ### Technical Analysis The session test writes authenticated Gumroad dashboard HTML to the fixed path `/tmp/gumroad-test.html`. Shared temporary directories are commonly writable by multiple local users. Using a predictable pathname without securely creating the file introduces two risks: - **Symlink or file-clobber risk:** A local attacker may create the path as a symbolic link before the command runs. The shell redirection can then overwrite a file accessible to the automation user. - **Information disclosure:** The dumped DOM may contain seller-account or dashboard information. The file is not assigned explicit restrictive permissions and is not removed after the test, allowing sensitive residual data to remain on disk. The exact readability and overwrite impact depend on operating-system protections, the automation user's privileges, its `umask`, and ownership of the target file. The documentation states that Chrome must not run as root, which limits but does not eliminate the local impact. ### Attack Path 1. A local attacker predicts that the session test will use `/tmp/gumroad-test.html`. 2. Before the test runs, the attacker creates a symbolic link at that path to a file writable by the automation account, or monitors the predictable path for newly written content. 3. The shell opens the fixed pathname for output before Chrome dumps the authenticated dashboard DOM. 4. In the symlink scenario, the selected target file is truncated and overwritte ...[truncated 890 chars]
Remediation: View remediation
"$tmp_file" 2>/dev/null grep -E "Dashboard/Index|logged_in_user|current_seller" "$tmp_file" | head ``` Where practical, keep the output in a private runtime directory owned by the automation user rather than in a shared `/tmp` directory. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The activation text is broad enough that the skill may be invoked for many Gumroad-related tasks without an explicit check that the user intended use of a pre-authenticated seller account. Because this skill operates with an existing authenticated browser profile, unintended invocation can expose account data or perform state-changing actions under the seller session.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly relies on a pre-authenticated Chrome profile but does not clearly warn users that invoking it may access session cookies, account data, and seller capabilities tied to a real Gumroad account. In this context, omission of that warning is dangerous because users may unknowingly authorize sensitive reads or modifications through an already-logged-in commercial account.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
- Always use `--user-data-dir=/home/openclaw/gumroad-profile` - Never clear cookies - Never use incognito/guest mode - Never run as root ## Quick Session Test

Static analysis

No suspicious patterns detected.