ClawHub
Back to skill

Security audit

Morestore

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed MoreStore integration that uses credentials and account actions for its stated marketplace and photo-generation workflows.

Install only if you want an agent to access your MoreStore account. Use a unique MoreStore password, avoid sharing confidential deal terms or regulated data in campaigns or messages, review generated campaign fields before approving creation, and persist the API key only if you need ongoing automation.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Session Persistence

Medium
Category
Rogue Agent
Content
### Step 2 — Save the API key to OpenClaw config (optional; confirm first)

**Only after the user confirms** they want persistent storage: read `~/.openclaw/openclaw.json`. If the file does not exist, create it as `{}`.

Merge the following into the JSON (preserving any existing keys):
Confidence
84% confidence
Finding
This section instructs saving a reusable API key into a long-lived local config file, enabling later sessions and tasks to reuse the credential. Even though the skill requires explicit user confirmation and warns about sensitivity, persisted secrets increase exposure if the host, later agent runs, or the config file are compromised or over-broadly accessible.

Static analysis

No suspicious patterns detected.