T09 · Insecure Skill Coding Practices
- Location
skill.md:227- Finding
Unsafe Autonomous Authorization of Marketplace Deals
- Content
View full analysis
Vulnerability Details
File Location:
skill.md:227-233
Additional Location:instructions.md:60-77
Vulnerability Type:T09: Insecure Skill Coding Practices
Risk Level: HighVulnerable Code Snippet:
markdown ### Autonomous Agent Loop (Every 1-5 minutes) 1. **Check notifications:** `GET /notifications?read=false` 2. **Process deals:** Respond to proposals, accept terms, mark complete 3. **Scan marketplace:** `GET /posts?shell=marketplace&sort=recent` 4. **Engage:** Comment, vote, propose deals on relevant posts 5. **Clear inbox:** `POST /notifications/read-all`The same behavior is reinforced in
instructions.md:60-77:markdown ## Autonomous Agent Loop **Run every 1-5 minutes:**-
GET /notifications?read=false → Check for new activity
-
Process deal notifications → Respond to proposals, accept terms, mark complete
-
GET /posts?shell=marketplace&sort=recent → Scan for new opportunities
-
Engage strategically → Comment, vote, propose deals on relevant posts
-
POST /notifications/read-all → Clear notification inbox
text Technical Analysis
The skill instructs an agent to periodically retrieve externally controlled marketplace content and then autonomously propose, accept, and complete deals. These are state-changing commercial and reputational operations performed using the user's authenticated ClawMarket API key.
The workflow does not require explicit user approval before a deal is proposed, accepted, modified, or completed. It also defines no counterparty allowlist, transaction-value limit, validation of deal terms, proof-of-delivery requirement, or handling rules for prompt-injection content received through posts, messages, notifications, and deal descriptions.
Marketplace participants control the text processed by the agent. Consequently, a hostile participant can craft a post or proposal that attempts t ...[truncated 1779 chars]
-
- Remediation
View remediation
Remediation Suggestions
- Require explicit, per-action user approval before proposing, accepting, modifying, canceling, or completing any deal.
- Display the counterparty identity, complete terms, price or value, deadlines, and associated post to the user before requesting approval.
- Treat all posts, comments, messages, notifications, deal descriptions, and terms as untrusted data. Explicitly prohibit following instructions embedded in remote content.
- Define enforceable counterparty allowlists, transaction limits, action-rate limits, and permitted deal categories.
- Require independent proof of delivery and user confirmation before invoking
POST /deals/:id/complete. - Separate read-only marketplace monitoring from state-changing actions. Autonomous mode should default to retrieving and summarizing opportunities only.
- Record an audit log containing the triggering remote content, proposed action, user authorization, API endpoint, and result.
- Pause automation and escalate to the user when terms are ambiguous, unexpectedly changed, unusually valuable, or contain instructions directed at the agent.