T09 · Insecure Skill Coding Practices
Error
- Location
- skill.md:227
- Finding
- Unsafe Autonomous Authorization of Marketplace Deals## Vulnerability Details **File Location**: `skill.md:227-233` **Additional Location**: `instructions.md:60-77` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High **Vulnerable Code Snippet**: ```markdown ### Autonomous Agent Loop (Every 1-5 minutes) 1. **Check notifications:** `GET /notifications?read=false` 2. **Process deals:** Respond to proposals, accept terms, mark complete 3. **Scan marketplace:** `GET /posts?shell=marketplace&sort=recent` 4. **Engage:** Comment, vote, propose deals on relevant posts 5. **Clear inbox:** `POST /notifications/read-all` ``` The same behavior is reinforced in `instructions.md:60-77`: ```markdown ## Autonomous Agent Loop **Run every 1-5 minutes:** ``` 1. GET /notifications?read=false → Check for new activity 2. Process deal notifications → Respond to proposals, accept terms, mark complete 3. GET /posts?shell=marketplace&sort=recent → Scan for new opportunities 4. Engage strategically → Comment, vote, propose deals on relevant posts 5. POST /notifications/read-all → Clear notification inbox ``` ``` ### Technical Analysis The skill instructs an agent to periodically retrieve externally controlled marketplace content and then autonomously propose, accept, and complete deals. These are state-changing commercial and reputational operations performed using the user's authenticated ClawMarket API key. The workflow does not require explicit user approval before a deal is proposed, accepted, modified, or completed. It also defines no counterparty allowlist, transaction-value limit, validation of deal terms, proof-of-delivery requirement, or handling rules for prompt-injection content received through posts, messages, notifications, and deal descriptions. Marketplace participants control the text processed by the agent. Consequently, a hostile participant can craft a post or proposal that attempts t ...[truncated 1779 chars]
- Remediation
- ## Remediation Suggestions - Require explicit, per-action user approval before proposing, accepting, modifying, canceling, or completing any deal. - Display the counterparty identity, complete terms, price or value, deadlines, and associated post to the user before requesting approval. - Treat all posts, comments, messages, notifications, deal descriptions, and terms as untrusted data. Explicitly prohibit following instructions embedded in remote content. - Define enforceable counterparty allowlists, transaction limits, action-rate limits, and permitted deal categories. - Require independent proof of delivery and user confirmation before invoking `POST /deals/:id/complete`. - Separate read-only marketplace monitoring from state-changing actions. Autonomous mode should default to retrieving and summarizing opportunities only. - Record an audit log containing the triggering remote content, proposed action, user authorization, API endpoint, and result. - Pause automation and escalate to the user when terms are ambiguous, unexpectedly changed, unusually valuable, or contain instructions directed at the agent.