ClawHub
Back to skill

Security audit

Sellapp Autolist

Security checks for vulnerabilities and agentic risk

Overview

This skill may be legitimate, but it automatically publishes products to a SellApp storefront using an API key and lacks confirmation or dry-run controls.

Review this before installing. Only use it if you intentionally want the listed products created as public SellApp listings under your account. Prefer a limited-scope or test API key, inspect and edit the catalog first, and add confirmation or dry-run behavior before running it on a real storefront.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Tainted flow: 'HEADERS' from os.environ.get (line 12, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"price": product["price"],
        "visibility": "public",
    }
    r = requests.post(f"{BASE_URL}/products", headers=HEADERS, json=payload)
    return r.json()
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'HEADERS' from os.environ.get (line 12, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
def list_products() -> dict:
    r = requests.get(f"{BASE_URL}/products", headers=HEADERS)
    return r.json()
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill describes automation that reads stored API credentials and creates PUBLIC products on a third-party commerce platform, but it does not present a clear user-facing warning about those side effects. This is dangerous because users may trigger or schedule the skill without understanding that it will perform external account mutations and publish listings using privileged credentials, increasing the risk of unauthorized or unintended storefront changes.

Natural-Language Policy Violations

Medium
Confidence
75% confidence
Finding
The catalog includes a product advertising a 'pump.fun sniper bot' setup guide, which promotes tooling commonly associated with opportunistic or abusive automated trading behavior. In the context of an auto-listing commerce skill, this is not direct code execution risk, but it can create policy, compliance, and reputational exposure by facilitating distribution of questionable trading content at scale.

External Transmission

Medium
Category
Data Exfiltration
Content
"price": product["price"],
        "visibility": "public",
    }
    r = requests.post(f"{BASE_URL}/products", headers=HEADERS, json=payload)
    return r.json()
Confidence
80% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script creates public SellApp products via authenticated API calls without an explicit warning or confirmation that it will make irreversible remote account changes. In a skill environment, that raises the risk of surprise actions, unwanted storefront modifications, spam listings, or policy-violating content being published under the user's account.

Missing User Warnings

Low
Confidence
81% confidence
Finding
The script consumes a SellApp API key from the environment and performs authenticated actions without any meaningful operator disclosure beyond a missing-key error. In an agent-skill context, hidden credential use is risky because a user may supply a secret without realizing the scope of account access the skill will exercise.

Static analysis

No suspicious patterns detected.