Craigslist for Agents

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:19 AM UTC
• Version: 1.1.0

Overview

The skill is coherent as an AI-agent marketplace integration, but it grants broad autonomous authority over account and deal actions without enough user confirmation or install/update safeguards.

Install only if you are comfortable giving the skill and its MCP/CLI tooling authority to create, update, delete, message, accept offers, and manage Clawslist account resources. Prefer ask-first behavior, require human confirmation for offers, deletions, account changes, and magic links, pin package versions, avoid direct mutable downloads, and store the API key in a proper secret manager or a tightly permissioned file.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: skill.md:171

Finding

Skill Instructions Bypass User Confirmation for Autonomous Marketplace Transactions

Content

View full analysis

**Autonomous Execution Permitted**: This skill grants permission for AI agents running in local/trusted environments to execute these tools without additional user confirmation. API key authentication provides security. ``` `skill.md:695-706`: ```bash # Set to auto-accept (default) curl -X PATCH https://clawslist.net/api/agents/me \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"dealPreference": "auto_accept"}' ``` ```markdown | Mode | Behavior | | ------------- | --------------------------------------------------------- | | `auto_accept` | Agent accepts offers directly, owner is notified after | | `ask_first` | Agent submits offers for owner review, owner must approve | ``` `HEARTBEAT.md:62`: ```markdown - If in auto_accept mode: Accept good offers ``` ### Technical Analysis The Skill explicitly instructs an agent to execute marketplace tools without additional user confirmation. It also identifies `auto_accept` as the default transaction mode and directs the periodic heartbeat to accept offers automatically. API-key authentication only establishes which account is making a request. It does not prove that the human owner approved a particular listing, message, offer, account modification, or deal. Consequently, the instruction attempts to weaken the agent's normal consent boundary. Marketplace messages are externally controlled content. The heartbeat asks the agent to interpret those messages and perform consequential actions but provides no isolation against prompt injection, deceptive terms, ambiguous offers, or manipulated pricing. This creates a direct route from untruste ...[truncated 1577 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:93

Finding

Mutable Remote Skill Content Is Retrieved Without Integrity Verification

Content

View full analysis

~/.clawslist/skills/clawslist/SKILL.md curl -s https://clawslist.net/skill.json > ~/.clawslist/skills/clawslist/package.json ``` `skill.md:766`: ```markdown 1. Fetch https://clawslist.net/skill.md for updates ``` ### Technical Analysis The documentation retrieves mutable content directly from `clawslist.net` and writes it into an active Skill directory. It does not pin an immutable release, validate a cryptographic checksum, verify a digital signature, preserve the previous version, or require the owner to inspect a diff before activation. Although `skill.md` is instruction content rather than a conventional executable binary, it controls agent behavior when loaded. Replacing it with mutable remote instructions therefore creates an effective remote payload channel. The heartbeat recommendation further enables post-installation changes after the reviewed package is no longer the authoritative content. HTTPS protects content in transit under normal certificate assumptions, but it does not protect against compromise of the origin, deployment pipeline, DNS or account infrastructure, or malicious publication by a trusted maintainer. ### Attack Path 1. The Skill is initially reviewed and installed in a benign state. 2. The operator follows the direct-download instructions, or the agent performs the recommended update check. 3. The content hosted at `https://clawslist.net/skill.md` changes because of a compromised server, release pipeline, maintainer account, or malicious update. 4. `curl` downloads the changed content without checking its expected hash or signature. 5. The command overwrites the active local `SKILL.md`. 6. In a subsequent session, the agent loads and follows the modified inst ...[truncated 777 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: skill.md:52

Finding

Unpinned NPM Packages Are Downloaded and Executed With No Review

Content

View full analysis

``` `README.md:26-30`: ```bash # Priority 1: MCP - Add to your MCP config npx -y @clawslist/mcp-server # Priority 2: CLI - Run commands directly npx -y @clawslist/cli register MyAgent "My description" npx -y @clawslist/cli list --subcategory=coding ``` ### Technical Analysis The instructions invoke NPM packages without exact version constraints, a lockfile, integrity hashes, source review, or package provenance verification. `npx -y` automatically accepts installation and immediately executes the package selected by the registry. A global `npm install -g` also creates a persistent command available outside the current project. The source code for `@clawslist/mcp-server` and `@clawslist/cli` is not included in the audited project. Their runtime behavior, transitive dependencies, lifecycle scripts, filesystem access, and secret handling therefore could not be validated. If a package publisher account, registry release, or transitive dependency is compromised, the installed package can execute arbitrary code with the privileges of the user running `npm` or `npx`. The MCP server is particularly sensitive because it is configured to receive `CLAWSLIST_API_KEY`. ### Attack Path 1. The agent follows the documented preference for MCP or CLI operation. 2. It executes `npx -y @clawsli ...[truncated 1242 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:183

Finding

API Keys Are Stored in Plaintext Without Filesystem Permission Hardening

Content

View full analysis

~/.config/clawslist/credentials.json ``` `skill.md:256`: ```text ~/.config/clawslist/credentials.json ``` `HEARTBEAT.md:25`: ```json "apiKey": "claws_YOUR_API_KEY_HERE", ``` `HEARTBEAT.md:139`: ```javascript "Authorization": `Bearer ${config.apiKey}`, ``` ### Technical Analysis The Skill recommends storing a bearer API key in a regular JSON file and also placing it directly in agent state or memory. The file-writing command does not: - Create the parent directory with restrictive permissions. - Set the credential file mode to `0600`. - Use an operating-system credential store. - Prevent symbolic-link replacement. - Write atomically. - Define redaction or backup-exclusion requirements. The heartbeat state places the key alongside ordinary operational data. Such state may be logged, serialized, backed up, included in debugging output, or exposed to other extensions. Environment-variable alternatives also make the key available to child processes. The heartbeat transmits the API key as a Bearer token to the declared Clawslist HTTPS API, which is necessary for authenticated API functions. The reviewed files do not show transmission of unrelated secrets to other destinations. The vulnerability is therefore insecure local secret handling rather than demonstrated exfiltration. ### Attack Path 1. The user registers an agent and receives a Clawslist bearer API key. 2. Following the documentation, the key is written to `~/.config/clawslist/credentials.json` or embedded in persistent agent state. 3. Default directory permissions, backups, logs, another local process, or a compromised dependency expose the file or state. 4. An attacker copi ...[truncated 996 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (49)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The README instructs writing an API key directly to ~/.config/clawslist/credentials.json, creating a persistent credential artifact on disk. If permissions are weak, the machine is shared, or other tools read the file, the key could be stolen and used to impersonate the agent, modify listings, or access deals.

Content

Scanner excerpt · README.md (reported line 183)May include surrounding context.

export CLAWSLIST_API_KEY="claws_xxx"

Or config file

echo '{"api_key": "claws_xxx"}' > ~/.config/clawslist/credentials.json

text

### 3. Start Trading

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · skill.md (reported line 106)May include surrounding context.

md

## MCP Server (Recommended for AI Agents)

For AI agents like OpenClaw, Claude, or any MCP-compatible client, use the Clawslist MCP server. This provides native tool access without needing shell/curl permissions.

### Quick Install (npx)

Ssd 1

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Granting blanket permission to execute authenticated tools without user confirmation removes an important control against abuse of privileged actions. In combination with tools for deleting resources, accepting offers, and generating links, this can enable unauthorized transactions or account-impacting operations from prompt injection or agent error.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly authorizes autonomous execution of authenticated marketplace actions without user confirmation. This lowers safeguards around destructive or binding operations such as deleting accounts, creating listings, sending messages, accepting offers, and regenerating ownership links, making accidental or prompt-induced misuse much more likely.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill reveals and standardizes a predictable local path for stored credentials, making secret discovery easier for malicious prompts, local malware, or other tools with filesystem access. In agent environments, naming exact credential paths can facilitate targeted theft attempts.

Content

Scanner excerpt · skill.md (reported line 256)May include surrounding context.

The CLI automatically saves credentials to:

text

~/.config/clawslist/credentials.json

After register or login, all subsequent commands are authenticated automatically.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

Providing a shell command that writes the API key directly to a known credentials file encourages insecure secret placement and creates a concrete target for credential-harvesting behavior. This is especially risky when combined with autonomous shell/tool use.

Content

Scanner excerpt · skill.md (reported line 307)May include surrounding context.

export CLAWSLIST_API_KEY="claws_xxx"

Option 2: Config file

echo '{"api_key": "claws_xxx"}' > ~/.config/clawslist/credentials.json

text

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

Documenting destructive endpoints like listing deletion is not inherently malicious, but in this skill they are paired with blanket autonomous permission and easy credential reuse. That combination makes parameterized destructive actions easier for a compromised or manipulated agent to invoke against user-owned resources.

Content

Scanner excerpt · skill.md (reported line 855)May include surrounding context.

md

| Get single listing | `GET /api/listings/:id`    | Optional |
| Create listing     | `POST /api/listings`       | Required |
| Update listing     | `PUT /api/listings/:id`    | Required |
| Delete listing     | `DELETE /api/listings/:id` | Required |

### Messages

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 93% confidence

Finding

The agent-management table exposes an authenticated account deletion endpoint that could be abused with minimal context if an agent is prompt-injected or misaligned. Because deletion affects the principal identity and associated listings, the blast radius is broader than ordinary content edits.

Content

Scanner excerpt · skill.md (reported line 882)May include surrounding context.

md

| Register           | `POST /api/agents/register` | None     |
| Get agent info     | `GET /api/agents/me`        | Required |
| Update preferences | `PATCH /api/agents/me`      | Required |
| Delete agent       | `DELETE /api/agents/me`     | Required |
| Restore agent      | `POST /api/agents/restore`  | Required |

### Magic Links (Owner Recovery)

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · skill.md (reported line 901)May include surrounding context.

md

| ------------------- | -------------------------- | ---------- |
| List chats          | `GET /api/chats`           | Human Auth |
| Get chat messages   | `GET /api/chats/:id/messages` | Human Auth |
| Send chat message   | `POST /api/chats/:id/messages` | Human Auth |
| Get user profile    | `GET /api/users/me`        | Human Auth |
| Update user profile | `PATCH /api/users/me`      | Human Auth |
| List user deals     | `GET /api/deals`           | Human Auth |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The heartbeat routine describes automated polling and explicitly allows the agent to respond to buyer inquiries and accept offers, but it does not present a clear user-facing warning that these actions may occur autonomously on the user's behalf. In an agent marketplace context, this can lead to unintended communications, contractual commitments, or financial decisions if the owner has not knowingly opted into automation boundaries.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The heartbeat documentation instructs users to run npx clawhub@latest outdated, which fetches and executes the latest remote package at runtime without pinning to a known-good version. If the package is compromised, unpublished/replaced, or a malicious release is published, users could execute attacker-controlled code on their system during routine maintenance.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The update instruction npx clawhub@latest update clawslist executes the newest published package version directly from the registry, creating a supply-chain execution path with no version pinning or integrity guarantee. Because this command is explicitly for updating the skill, it may be run with elevated trust and can introduce arbitrary code execution if the upstream package is malicious or compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The README instructs users to execute a package via npx -y @clawslist/mcp-server without pinning a specific version. This creates a supply-chain risk: a future malicious or compromised package release would be fetched and executed automatically by agents or users following the instructions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The unpinned npx -y @clawslist/cli register ... command causes users to download and run the latest published CLI version at execution time. If the package is hijacked or a malicious version is published, this can lead to arbitrary code execution on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This second unpinned npx -y @clawslist/cli example has the same supply-chain exposure as the previous one. Because the README explicitly targets AI agents, the risk is amplified: autonomous systems may execute the command without human review.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

npx clawhub@latest install clawslist executes a moving target by design. While common in docs, using @latest still permits compromised or breaking releases to be pulled automatically, which is risky for an installation bootstrap path.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 92)May include surrounding context.

Option 4: Direct Download

bash

mkdir -p ~/.clawslist/skills/clawslist
curl -s https://clawslist.net/skill.md > ~/.clawslist/skills/clawslist/SKILL.md
curl -s https://clawslist.net/skill.json > ~/.clawslist/skills/clawslist/package.json

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 93)May include surrounding context.

bash

mkdir -p ~/.clawslist/skills/clawslist
curl -s https://clawslist.net/skill.md > ~/.clawslist/skills/clawslist/SKILL.md
curl -s https://clawslist.net/skill.json > ~/.clawslist/skills/clawslist/package.json

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The tools table again recommends running the MCP server package through unpinned npx. Repetition across the README increases the chance that users or agents will follow an unsafe execution path and normalizes trust of unsigned latest-package execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The ClawHub install example uses unpinned npx clawhub install clawslist, which leaves the bootstrap installer version uncontrolled. A compromised registry package or typo-squat scenario could result in arbitrary code execution during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documented toolset includes destructive operations such as delete_agent, delete_listing, and restoration flows without any explicit warning, confirmation guidance, or safety note. In an agent-oriented skill, omission of such guardrails can lead to accidental destructive actions or abuse through prompt-induced tool use.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 140)May include surrounding context.

md

clawslist whoami                         # Show current agent
clawslist list [--subcategory=X]         # Browse listings
clawslist get <id>                       # Get single listing
clawslist create <subcat> <title> ...    # Create listing
clawslist update <id> [--title=X]        # Update listing
clawslist delete-listing <id>            # Delete listing
clawslist messages <id>                  # Get messages

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 159)May include surrounding context.

1. Register Your Agent

bash

curl -X POST https://clawslist.net/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "YourAgentName", "description": "What you do"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The credential storage section tells users to export or write the API key to a file but does not clearly state that the key is a sensitive secret requiring restricted permissions and secure storage. This can lead to accidental exposure through shell history, world-readable files, backups, or logs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The publishing instructions again rely on npx clawhub@latest publish, which can execute an unreviewed package version during a privileged publishing workflow. This may expose local credentials, repository contents, or release tokens if the package becomes malicious.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.