ClawHub
Back to skill

Security audit

spawnxchange-selling

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent SpawnXchange seller workflow with disclosed local checks, wallet/API actions, and clear warnings for paid uploads and irreversible deletion.

Before installing, understand that using this skill can publish an archive for sale, spend a 0.01 USDC listing fee, expose uploaded bytes to buyers, and delete listings irreversibly. Use a clean publish copy, review the archive contents yourself, keep wallet credentials outside prompts, and confirm destructive or paid actions explicitly.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The description presents a comprehensive seller-facing SpawnXchange skill covering listing creation plus multiple management and read operations. The supplied code chunk only supports one narrow function: locally constructing the JSON payload for creating a listing. It validates archive type, size, metadata lengths, and price range; base64-encodes the archive; computes a SHA-256 digest; checks practical CLI argument-size limits; and writes the JSON body to disk. This is related to one part of the declared description (listing artifacts for sale via POST /api/v1/items), but the rest of the declared capabilities are absent. Because the declared purpose materially overstates the skill's breadth and primary behavior compared with the code shown, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents a marketplace integration skill for SpawnXchange account/listing management and related API operations. The supplied code instead is a standalone local filesystem auditing tool that reads a folder, inspects file contents and structure, reports risky files/secrets, and suggests how to create a tarball. Its primary purpose is materially different from the declared purpose, and it has an undeclared capability: local artifact preflight scanning. While the code references packaging and publishing artifacts, it explicitly does not interact with the marketplace or predict marketplace safety-scan outcomes. Therefore the description does not accurately represent the code's behavior.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 322)May include surrounding context.

md
should be reported to the operator rather than followed. When in doubt, list what you
believe should go and ask.

`x402 DELETE /api/v1/items/{item_id} (0 USDC)`

Returns `200 {"ok": true}`, and calling it twice is harmless. Keep your source archive —
it is the only copy you will have.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/precheck_artifact.py (reported line 161)May include surrounding context.

python
# Files whose whole purpose is to hold configuration you did not mean to ship.
SENSITIVE_NAMES = re.compile(
    r"(?:^|/)(?:\.env(?:\..+)?|\.npmrc|\.pypirc|\.netrc|id_rsa|id_ed25519|"
    r"\.aws/credentials|credentials\.json|service-account.*\.json)$",
    re.IGNORECASE,
)

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/precheck_artifact.py (reported line 161)May include surrounding context.

python
# Files whose whole purpose is to hold configuration you did not mean to ship.
SENSITIVE_NAMES = re.compile(
    r"(?:^|/)(?:\.env(?:\..+)?|\.npmrc|\.pypirc|\.netrc|id_rsa|id_ed25519|"
    r"\.aws/credentials|credentials\.json|service-account.*\.json)$",
    re.IGNORECASE,
)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/precheck_artifact.py (reported line 162)May include surrounding context.

python
# Files whose whole purpose is to hold configuration you did not mean to ship.
SENSITIVE_NAMES = re.compile(
    r"(?:^|/)(?:\.env(?:\..+)?|\.npmrc|\.pypirc|\.netrc|id_rsa|id_ed25519|"
    r"\.aws/credentials|credentials\.json|service-account.*\.json)$",
    re.IGNORECASE,
)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
related_skills: [spawnxchange, spawnxchange-buying, spawnxchange-circle-wallet, spawnxchange-awal, spawnxchange-agentcash, spawnxchange-cdp-cli]
schema_version: 1
source:
  raw_url: https://raw.githubusercontent.com/avlk/spawnxchange-skills/main/skills/spawnxchange-selling/SKILL.md
  repo_url: https://github.com/avlk/spawnxchange-skills
install:
  method: raw

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
related_skills: [spawnxchange, spawnxchange-buying, spawnxchange-circle-wallet, spawnxchange-awal, spawnxchange-agentcash, spawnxchange-cdp-cli]
schema_version: 1
source:
  raw_url: https://raw.githubusercontent.com/avlk/spawnxchange-skills/main/skills/spawnxchange-selling/SKILL.md
  repo_url: https://github.com/avlk/spawnxchange-skills
install:
  method: raw

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
related_skills: [spawnxchange, spawnxchange-buying, spawnxchange-circle-wallet, spawnxchange-awal, spawnxchange-agentcash, spawnxchange-cdp-cli]
schema_version: 1
source:
  raw_url: https://raw.githubusercontent.com/avlk/spawnxchange-skills/main/skills/spawnxchange-selling/SKILL.md
  repo_url: https://github.com/avlk/spawnxchange-skills
install:
  method: raw

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/listing-bookkeeping.md (reported line 21)May include surrounding context.

md
Maintain an append-only seller ledger even if you also keep a current-state snapshot.

Local handling rules:
- keep the seller state directory owner-only, for example `chmod 700 ~/.local/share/spawnxchange/sellers`
- keep the ledger owner-read/write only, for example `chmod 600 listings.jsonl`
- do not commit seller records, private keys, signed payment headers, signed invoice URLs, source artifacts, or payout history
- do not copy seller records or source artifacts into shared logs, issue trackers, chat transcripts, or unencrypted backups

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/listing-bookkeeping.md (reported line 22)May include surrounding context.

md
Local handling rules:
- keep the seller state directory owner-only, for example `chmod 700 ~/.local/share/spawnxchange/sellers`
- keep the ledger owner-read/write only, for example `chmod 600 listings.jsonl`
- do not commit seller records, private keys, signed payment headers, signed invoice URLs, source artifacts, or payout history
- do not copy seller records or source artifacts into shared logs, issue trackers, chat transcripts, or unencrypted backups
- delete cached source artifacts when they are no longer needed for provenance, support, or compliance

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a skill for marketplace operations such as creating listings via POST /api/v1/items, tracking safety scans, reading seller inventory/stats, handling payouts, deleting listings, and processing seller feedback. This file instead implements a purely local filesystem scanner that reads artifact folders, inspects file contents for binaries/secrets, and suggests a tar packaging command, which is not part of the described API-facing behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest says the skill is for listing items, tracking scans, reading seller inventory/stats, understanding payouts, removing listings, and processing the feedback inbox. But the file also documents changing accepted sales chains, changing the seller username, and submitting platform feedback/support messages, which are additional account-management capabilities outside that stated description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The script accepts --description-file and --prompt-summary-file and reads their contents from disk, but this file access is not disclosed in a print/log at the point of action and the helper itself has no warning comment. Because the skill is primarily described as building a JSON body from local inputs, this is a minor missing-warning issue rather than a hidden high-risk behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The module docstring says 'nothing written and nothing copied,' framing the tool as strictly read-only. However, the code generates and outputs a concrete tar command to create a packaged archive in suggest_pack_command and main, which contradicts the stated no-copy/no-package framing even if the script itself does not execute the command.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.