ClawHub
Back to skill

Security audit

Morestore

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed MoreStore marketplace integration that handles credentials and business actions with explicit user confirmation gates.

Install only if you are comfortable letting the agent use your MoreStore account, upload product images, create marketplace campaigns, update prospect statuses, and send campaign messages when you ask it to. Prefer session-only API key use unless you need ongoing access, and remove or rotate the key after use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: morestore
description: Access the MoreStore A2A marketplace — sign up or log in for an API key, create buyer/seller campaigns, generate Perfect Scene and holiday/event product photos via API, find matches, analyze brands, and manage B2B pipelines.
metadata: {"openclaw": {"emoji": "🏪", "homepage": "https://morestore.ai", "env": ["MORESTORE_API_KEY"], "credential_note": "Authenticated routes need X-API-Key (MORESTORE_API_KEY from signup/login). Initial signup/login requires account email and password supplied by the user; do not invent credentials."}}
---

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
Follow the MoreStore skill (Safety + One-shot). Use this onboarding JSON:
{"account":{"email":"user@example.com","password":"…","full_name":"…"},"agent":{"deal_type":"buyer","service_prompt":"…"}}

Staged flow — use separate turns or explicit user replies between stages; do not skip confirmations:

1) Auth only: POST /api/auth/signup or on 409 POST /api/auth/login. Obtain MORESTORE_API_KEY from user.api_key. Do not write openclaw.json yet.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.

md
**Before using marketplace APIs, you must be authenticated.** Obtain `MORESTORE_API_KEY` and send it as **`X-API-Key`** on authenticated routes.

> **NO EMAIL VERIFICATION.** MoreStore signup completes in a single API call and returns the API key directly in the `201` response. There is **no** verification code, no email step, and no waiting. The endpoints `/api/auth/verify-code` and `/api/auth/resend-code` **do not exist** — never call them, never ask the user for a code from their inbox, and never tell the user to "check their email" before continuing. If signup returns `201`, you already have everything you need; go straight to Step 2.

### Step 1 — Check if the user already has a MoreStore account

Behavior Manipulation

Medium
Category
Prompt Injection
Confidence
75% confidence
Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.

md
**Before using marketplace APIs, you must be authenticated.** Obtain `MORESTORE_API_KEY` and send it as **`X-API-Key`** on authenticated routes.

> **NO EMAIL VERIFICATION.** MoreStore signup completes in a single API call and returns the API key directly in the `201` response. There is **no** verification code, no email step, and no waiting. The endpoints `/api/auth/verify-code` and `/api/auth/resend-code` **do not exist** — never call them, never ask the user for a code from their inbox, and never tell the user to "check their email" before continuing. If signup returns `201`, you already have everything you need; go straight to Step 2.

### Step 1 — Check if the user already has a MoreStore account

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

This section instructs the agent to persist a reusable API key into $HOME/.openclaw/openclaw.json, enabling later sessions and tasks to reuse the credential. Even though the text requires confirmation and warns about sensitivity, persisted long-lived credentials increase the blast radius if the host, config file, or another task gains access to that file.

Content

Scanner excerpt · SKILL.md (reported line 360)May include surrounding context.

md
### Step 2 — Save the API key to OpenClaw config (optional; confirm first)

**Only after the user confirms** they want persistent storage: read `~/.openclaw/openclaw.json`. If the file does not exist, create it as `{}`.

Merge the following into the JSON (preserving any existing keys):

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 379)May include surrounding context.

}

text

Write the updated file back to `~/.openclaw/openclaw.json`. Remind the user this file is **sensitive** (future tasks may reuse the key); they should **`chmod 600`** (or equivalent) and **rotate/remove** the key when no longer needed.

If the user **does not** want persistence, skip writing; they can `export MORESTORE_API_KEY='…'` for the current session only (never echo the full key in logs).

Static analysis

No suspicious patterns detected.