Security audit

AuctionClaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is a legitimate external agent-auction integration, but it asks users to paste an API key into chat and broadly defaults routine requests to a third-party service.

Review before installing. Use only if you are comfortable sending task prompts to 638Labs and downstream agents, and avoid pasting API keys into chat; configure the key through a safer local secret mechanism if possible, restrict file permissions, and rotate any key already shared in a conversation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:25
Finding: Insecure Collection and Plaintext Storage of an API Credential
Content: View full analysis
API Keys and copy their key 3. Ask them to provide the key 4. Save it to ~/.openclaw/.env as STOLABS_API_KEY=key-xxxx 5. Confirm setup is complete ``` ### Technical Analysis The setup procedure directs the Agent to ask the user to provide an API key through the conversation and then save that credential as plaintext in `~/.openclaw/.env`. Requiring an API key is consistent with the Skill's declared external service integration. However, collecting the key through the Agent conversation exceeds the minimum privilege necessary because the user could configure `STOLABS_API_KEY` directly through a trusted local interface or secret manager. A credential disclosed in a conversation may be retained in session history, application telemetry, debugging output, model-provider logs, or audit records. Storing the key in a plaintext environment file creates an additional exposure point. The instructions do not require restrictive file permissions, atomic file updates, preservation of existing configuration, or redaction of the credential from subsequent output. The file path is under the current user's home directory, so this does not by itself establish system-level privilege escalation. Nevertheless, it grants the Agent access to a reusable authentication secret and permission to modify persistent user configuration. ### Attack Path 1. The Skill determines that `STOLABS_API_KEY` is not currently configured. 2. Following the setup instructions, the Agent asks the user to paste the API key into the conversation. 3. The credential becomes part of the conversation and may consequently appear in session storage, logs, telemetry, ...[truncated 990 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The skill explicitly instructs collection of a user's API key and storage in ~/.openclaw/.env, which is a credential-handling pattern with real risk. Because the skill is specifically about routing tasks to a third-party service, compromise of this key could enable unauthorized use, billing abuse, and access to associated service data or capabilities.
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
md
1. Tell the user to sign up at https://app.638labs.com 2. Tell them to go to Account > API Keys and copy their key 3. Ask them to provide the key 4. Save it to ~/.openclaw/.env as STOLABS_API_KEY=key-xxxx 5. Confirm setup is complete ## Available Tools

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The setup flow instructs the operator to ask the user for an API key and store it in a local .env file, but it does not warn about safe credential handling, least exposure, or alternatives that avoid sharing secrets through the conversational channel. This creates unnecessary risk of credential leakage via chat logs, transcripts, shell history, backups, or overly permissive filesystem access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill makes the auction tool the default for nearly all unspecified requests, which can cause user prompts and data to be sent to a third-party routing service without sufficiently explicit user intent. In a broad assistant environment, this increases the chance of unintended external disclosure, unexpected costs, or execution through unvetted downstream agents.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The category inference uses very common phrases like "analyze," "help me think through," or "explain," which are too broad and can accidentally match ordinary assistant requests. This can misroute routine or sensitive conversations into an external agent marketplace, exposing content unnecessarily and triggering actions the user did not clearly request.
Content: No source excerpt is available for this finding.