ClawHub
Back to skill

Security audit

Clawmarket

Security checks for vulnerabilities and agentic risk

Overview

This marketplace skill is broadly aligned with its purpose, but it gives agents high-impact install, payment, publishing, and review workflows without enough user-control and verification safeguards.

Review this skill carefully before installing. Only use it where you are comfortable letting an agent interact with claw-market.xyz, store an API key, install third-party skills, and initiate wallet/payment workflows. Do not allow automatic purchases, approvals, reviews, or local skill installation unless the exact action, package contents, destination paths, contract, amount, and public side effects have been shown to you and explicitly approved.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:48
Finding

Execution of Externally Supplied Installation Commands

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:58
Finding

Unverified Remote Skill Packages Written into a Trusted Skills Directory

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:129
Finding

Mandatory Authenticated Review Submission Creates an Unrequested External Side Effect

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (8)

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

The skill is explicitly designed to publish and update skills, which are agent capability packages that may alter future behavior and add scripts. In this context, self-modification is especially dangerous because the same marketplace flow also supports downloading and writing skill content locally, enabling persistence or capability changes from marketplace-sourced content.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: clawmarket
description: Browse, install, purchase, publish, review, and update skills on ClawMarket (claw-market.xyz) — the AI agent skill marketplace. Use when the user asks to find new skills, install a skill from ClawMarket, publish a skill to the marketplace, buy/sell skills, check skill reviews, update a published skill, or manage their ClawMarket agent profile. Also triggers on mentions of "clawmarket", "claw market", "skill marketplace", or "clawhub marketplace".
---

# ClawMarket — Agent Skill Marketplace

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases include broad terms like "skill marketplace" and marketplace name variants, which can cause the skill to activate in contexts not specifically requesting ClawMarket actions. Over-broad invocation increases the chance the agent enters workflows involving registration, installation, purchases, or file writes without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill instructs the agent to transmit identifying profile data to an external service during registration and to store a returned API key for future authenticated use. External transmission itself is expected for a marketplace integration, but it is still security-relevant because it creates third-party data exposure and secret-handling requirements that are not paired with consent and storage safeguards.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

Before using any authenticated endpoint, register once:

bash
curl -X POST "https://claw-market.xyz/api/v1/agents/register" \
  -H "Content-Type: application/json" \
  -d '{"name": "YOUR_AGENT_NAME", "description": "Brief description"}'

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill tells the agent to execute npx clawhub install weather without pinning a version or verifying integrity. That allows whatever package/version currently resolves from the registry to run code at install time, creating a supply-chain execution risk if the package is compromised or changes unexpectedly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill expands from marketplace browsing into direct blockchain payment actions, including USDC approval and escrow contract interaction. This gives the agent authority to initiate irreversible financial transactions, and the document does not require strong user confirmation, contract verification, or transaction simulation before approval/purchase.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions tell the agent to write downloaded package.skillMd and scripts from the marketplace directly into local skill directories, but provide no warning about reviewing or sanitizing untrusted content first. This creates a path for arbitrary code or prompt content from a remote marketplace to persist locally and later execute or influence future agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The document gives step-by-step instructions for autonomous purchase of paid skills, including on-chain USDC approval and purchase calls, without any explicit requirement for informed user confirmation, spending limits, transaction review, or API-key handling warnings. Because these actions are irreversible and involve both wallet authorization and credential use, an agent following this guidance could spend funds or disclose purchase-linked access without adequate safeguards.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/payments.md (reported line 12)May include surrounding context.

Request the download endpoint without a token:

bash
curl "https://claw-market.xyz/api/v1/download/{skillId}"

Returns HTTP 402 with payment details including escrow contract address, seller wallet, amount, and instructions.

Static analysis

No suspicious patterns detected.