ClawHub
Back to skill

Security audit

PriceClaw

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly fits a price lookup and submission service, but it includes a direct-token authentication path that conflicts with its claim that the agent will not handle provider tokens.

Review this skill carefully before installing. Prefer the browser OAuth setup, do not paste GitHub, Google, or Discord access tokens into the agent, and only allow API key persistence if you are comfortable storing the PriceClaw key in OpenClaw configuration files.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:74
Finding

Over-Privileged Provider Token Transmission and Plaintext API Key Storage

Content
View full analysis
" } ``` Returns `{agent_id, api_key, message}`. The access token is used once to verify identity and is not stored by PriceClaw. Supported providers: `github`, `google`, `discord`. If the identity already has a PriceClaw agent, this returns 409 — use `/v1/auth/reissue` instead (see below). ### Key Reissue Lost your key? Use: ``` POST /v1/auth/reissue Content-Type: application/json { "provider": "github", "access_token": "" } ``` ``` ### Technical Analysis The Skill directs the agent to persist the PriceClaw API key in `~/.openclaw/.env` or an `openclaw.json` environment block. These are plaintext configuration locations, and the Skill does not prescribe restrictive file permissions, encryption, use of an operating-system credential manager, or safeguards against backups and accidental repository inclusion. User confirmation controls whether the write occurs, but it does not protect the credential after storage. The alternative registration and key-reissue workflows also i ...[truncated 2538 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
- PRICECLAW_API_KEY
      bins: []
      config:
        - "~/.openclaw/.env"
        - "~/.openclaw/openclaw.json"
    os:
      - linux

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
- PRICECLAW_API_KEY
      bins: []
      config:
        - "~/.openclaw/.env"
        - "~/.openclaw/openclaw.json"
    os:
      - linux

Credential Access

High
Category
Privilege Escalation
Confidence
83% confidence
Finding

This duplicate finding points to the same risky behavior: the agent is instructed it may accept a provider access token from the user. Third-party access tokens are highly sensitive credentials, and normalizing their submission to the agent increases the risk of compromise well beyond the local PriceClaw API key.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

Registration (alternative: direct token)

If the user explicitly provides a provider access token (e.g. a GitHub Personal Access Token), you can register directly. Only use this method if the user initiates it — prefer the browser flow above.

text
POST /v1/auth/register

Credential Access

High
Category
Privilege Escalation
Confidence
83% confidence
Finding

This duplicate finding points to the same risky behavior: the agent is instructed it may accept a provider access token from the user. Third-party access tokens are highly sensitive credentials, and normalizing their submission to the agent increases the risk of compromise well beyond the local PriceClaw API key.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

Registration (alternative: direct token)

If the user explicitly provides a provider access token (e.g. a GitHub Personal Access Token), you can register directly. Only use this method if the user initiates it — prefer the browser flow above.

text
POST /v1/auth/register

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

The example request body explicitly includes a user-provided access token, which operationalizes collection of sensitive third-party credentials by the agent. Concrete examples make misuse more likely and can lead to users pasting reusable provider tokens into an environment where they may be stored in history, telemetry, or logs.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

{ "provider": "github", "access_token": "" }

text

Credential Access

High
Category
Privilege Escalation
Confidence
78% confidence
Finding

The statement that the access token is 'used once' and 'not stored by PriceClaw' reduces server-side persistence risk, but it does not address exposure within the agent/runtime itself. Users may infer the path is safe and provide highly privileged provider credentials, despite residual risk from prompt history, client logs, or intermediary tooling.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

}

text

Returns `{agent_id, api_key, message}`. The access token is used once to verify identity and is not stored by PriceClaw.

Supported providers: `github`, `google`, `discord`. If the identity already has a PriceClaw agent, this returns 409 — use `/v1/auth/reissue` instead (see below).

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 586)May include surrounding context.

If you submitted a price by mistake or it's no longer accurate, soft-delete it. Only the submitting agent can delete their own entries (others get 403).

text
DELETE /v1/prices/{id}

Soft-deleted prices are filtered from all read endpoints.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest description says to use the skill whenever someone 'need[s] the price of a product or service' or has 'observed a price worth recording.' This is a wide activation scope that could match many ordinary conversations about prices, without clear exclusion conditions or narrower trigger constraints.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
## Authentication

All write requests require: `Authorization: Bearer $PRICECLAW_API_KEY`

Base URL: `https://priceclaw.io/v1`

Static analysis

No suspicious patterns detected.