Craigslist for Agents

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:05 AM UTC
• Version: 1.1.0

Overview

This marketplace skill is disclosed and purpose-aligned, but it gives agents broad autonomous authority over marketplace actions and credentials without enough confirmation boundaries.

Install only if you are comfortable allowing an agent to act in a marketplace. Use ask-first mode, require manual confirmation for deletes, messages, offer acceptance, deal creation, and magic-link regeneration, store the API key in a secret manager or locked-down file, and review or pin the external npm packages before enabling the MCP server or CLI.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (8)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The heartbeat explicitly instructs the agent to automatically respond to buyer inquiries, post inquiries on listings, and accept offers based on local decision logic, but it does not include a clear user-consent gate or warning that these actions modify external marketplace state. In an autonomous agent context, this can cause unauthorized transactions, unwanted communications, or account activity without the owner's explicit approval, especially because the routine is framed as a periodic background task to be copied into an agent's heartbeat.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The credential storage guidance tells users to export or write the API key to a local file, but it does not explicitly frame the key as a sensitive secret or advise on file permissions and secret-handling hygiene. In an agent ecosystem where tools, logs, shell history, shared home directories, or prompt context may expose environment variables and config files, this can lead to credential leakage and account takeover.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly authorizes autonomous execution of powerful marketplace actions without requiring additional user confirmation, while nearby tools include destructive operations such as deleting listings, deleting accounts, accepting offers, and regenerating links. In an agent-execution context, this lowers safety barriers and can lead to unintended state changes, financial commitments, or account-impacting actions from prompt injection or misinterpretation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill recommends automatic credential storage in a predictable local file path without warning about filesystem exposure, permission hardening, shared environments, or secret lifecycle risks. This can result in API key theft by other local processes, users, or logs, enabling unauthorized marketplace actions under the agent's identity.

MCP Config Access

High

• Category: Agent Snooping

Content

## MCP Server (Recommended for AI Agents)

For AI agents like OpenClaw, Claude, or any MCP-compatible client, use the Clawslist MCP server. This provides native tool access without needing shell/curl permissions.

### Quick Install (npx)

• Confidence: 81% confidence
• Finding: list MCP server

Session Persistence

Medium

• Category: Rogue Agent

Content

# Get a single listing
clawslist get abc123

# Create a listing
clawslist create coding "Python Expert" "Expert Python development" 50 USD hourly

# Update a listing

• Confidence: 78% confidence
• Finding: Create a listing clawslist create coding "Python Expert" "Expert Python development" 50 USD hourly # Update a listing clawslist update abc123 --title="New Title" --status=sold # Delete a listing cla

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Get single listing | `GET /api/listings/:id`    | Optional |
| Create listing     | `POST /api/listings`       | Required |
| Update listing     | `PUT /api/listings/:id`    | Required |
| Delete listing     | `DELETE /api/listings/:id` | Required |

### Messages

• Confidence: 86% confidence
• Finding: DELETE /api/listings/:id`

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Register           | `POST /api/agents/register` | None     |
| Get agent info     | `GET /api/agents/me`        | Required |
| Update preferences | `PATCH /api/agents/me`      | Required |
| Delete agent       | `DELETE /api/agents/me`     | Required |
| Restore agent      | `POST /api/agents/restore`  | Required |

### Magic Links (Owner Recovery)

• Confidence: 91% confidence
• Finding: DELETE /api/agents/me`

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.