Planet Express Marketplace

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:51 PM UTC
• Version: 2.0.0

Overview

The skill matches its file marketplace purpose, but it needs review because it guides agents through real blockchain payments and file exchange without explicit consent or content-safety guardrails.

Install only if you intend to let an agent interact with this marketplace. Require explicit approval before any purchase, listing fee, or transaction submission; verify network, price, recipient, and listing details; treat all marketplace files as untrusted; and pin or isolate any SDK installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:100

Finding

Unpinned Third-Party SDK Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 100
Vulnerability Type: Unpinned third-party dependencies from external package registries
Risk Level: Medium

Vulnerable Code Snippet:

text

Install SDK: `npm i dropclaw` or `pip install dropclaw`

Technical Analysis

The documentation instructs users to install the dropclaw package from either npm or PyPI without specifying an audited version, integrity hash, lockfile, registry URL, or publisher verification procedure. These commands therefore resolve the package dynamically at installation time.

Because the installed artifact can change after this Skill has been reviewed, package-owner compromise, registry-account takeover, or publication of a malicious future release could cause users to retrieve attacker-controlled code. Depending on the package manager and package contents, malicious code could run through npm lifecycle scripts during installation or when the installed SDK is imported or invoked.

The project does not itself contain or execute a malicious payload. The issue is the unsafe dependency-installation recommendation and its exposure to an external software supply chain.

Attack Path

1. An attacker compromises the relevant npm or PyPI publisher account, registry artifact, or upstream release process.
2. The attacker publishes a malicious version of the package under the expected dropclaw name.
3. A user follows the documented npm i dropclaw or pip install dropclaw instruction.
4. Since no version or integrity value is pinned, the package manager resolves and downloads the attacker-controlled release.
5. Malicious npm installation hooks may execute during installation, or malicious package code may execute when the SDK is imported or used.
6. The payload runs with the privileges and environmental access of the installing user or subsequent SDK process.

Impact Assessment

Successful exploitation could permit a ...[truncated 437 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace floating installation commands with exact, previously audited package versions, such as dropclaw@X.Y.Z for npm and dropclaw==X.Y.Z for Python.
2. Provide lockfiles and verify package integrity using trusted checksums, npm integrity metadata, or hash-checked Python requirements.
3. Document the expected package publisher, official registry location, source repository, and release-signing or provenance information.
4. Review each dependency update before changing the pinned version, including package ownership, lifecycle scripts, transitive dependencies, and release provenance.
5. Recommend installation in an isolated, least-privileged environment without wallet secrets or unrelated credentials.
6. Disable unnecessary npm lifecycle scripts during installation where compatible, and use reproducible installation mechanisms such as npm ci or pip install --require-hashes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directly instructs users to initiate paid actions and exchange file content, but it does not prominently warn that these operations can incur real financial charges or that purchased/uploaded files may contain untrusted or harmful content. In an agent setting, insufficient disclosure increases the risk of unintended payments, unsafe handling of external files, and user confusion about when money will be spent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.