Blocket Watcher - Sweden

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:56 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Blocket listing watcher that uses local config, a user timer, and Telegram notifications in ways that match its stated purpose.

Install only if you are comfortable running a user-level systemd timer that polls Blocket every hour and sends listing details, search terms, and optional config summaries to the Telegram chat ID you configure. Keep config.json and seen.json private because they can contain personal chat IDs and search preferences.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a monitoring skill whose main function is scheduled Blocket polling, deduplication, and alerting on new listings. The supplied code chunk does none of that. Instead, it is an onboarding/helper utility that reads config.json, composes a human-readable summary of configured queries, includes instructions for making delta changes, and sends that text to Telegram via openclaw. The Telegram sending detail is consistent with the description, but the primary behavior is materially different from the declared search-monitoring/polling purpose. Therefore this code chunk does not accurately represent the declared behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The declared description emphasizes scheduled Blocket.se search monitoring, deduplication of ads, and Telegram notifications for new listings. The supplied code chunk does not show polling Blocket, using the blocket CLI, deduplicating by ad ID, or sending new listing alerts. Instead, it is an onboarding wrapper that runs onboard.py, and its comment states that it posts the current config to Telegram and asks for delta-only replies. That is a materially different purpose from the declared monitoring/alerting behavior, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 15)May include surrounding context.

Quick setup

bash

mkdir -p ~/.openclaw/scripts
cp -r blocket-watch ~/.openclaw/scripts/
cd ~/.openclaw/scripts/blocket-watch
cp config.example.json config.json

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 67)May include surrounding context.

md

Run `blocket --help` for your CLI version.

## systemd

Copy `systemd/blocket-watch.service` and `systemd/blocket-watch.timer` into `~/.config/systemd/user/`. **Edit** the `.service` file so `WorkingDirectory` and `ExecStart` point to your install path (defaults assume `~/.openclaw/scripts/blocket-watch`).

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 73)May include surrounding context.

md

5. `cp seen.example.json seen.json` (or start with `{"ids":[]}`).
6. `chmod +x poll.sh onboard.sh`
7. Optional: install `systemd/blocket-watch.service` and `blocket-watch.timer` — **edit** `WorkingDirectory` and `ExecStart` in the service file to match step 3.
8. `systemctl --user enable --now blocket-watch.timer`

## Operations

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

5. `cp seen.example.json seen.json` (or start with `{"ids":[]}`).
6. `chmod +x poll.sh onboard.sh`
7. Optional: install `systemd/blocket-watch.service` and `blocket-watch.timer` — **edit** `WorkingDirectory` and `ExecStart` in the service file to match step 3.
8. `systemctl --user enable --now blocket-watch.timer`

## Operations

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This is a code file, so safety-critical operations like network transmission of system data should have some form of user disclosure. The comment at L2 states that the skill will post the current config to Telegram, but the shell wrapper itself provides no confirmation prompt, print/log notice, or other user-facing warning before executing onboard.py.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · onboard.py (reported line 96)May include surrounding context.

python

def run_blocket(argv: list[str]) -> dict:
    cmd = ["blocket", *argv]
    r = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
    if r.returncode != 0:
        raise RuntimeError(f"blocket failed: {' '.join(cmd)}\n{r.stderr or r.stdout}")
    if not r.stdout.strip():

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · poll.py (reported line 63)May include surrounding context.

python

def run_blocket(argv: list[str]) -> dict:
    cmd = ["blocket", *argv]
    r = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
    if r.returncode != 0:
        raise RuntimeError(f"blocket failed: {' '.join(cmd)}\n{r.stderr or r.stdout}")
    if not r.stdout.strip():

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · poll.py (reported line 86)May include surrounding context.

python

"--message",
        body,
    ]
    r = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
    if r.returncode != 0:
        print(r.stderr or r.stdout, file=sys.stderr)
        raise RuntimeError("openclaw message send failed")

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file states that the skill sends Telegram notifications via openclaw message send, which implies data leaves the local system to a third-party messaging platform. The README describes the behavior functionally, but it does not explicitly warn users about the privacy implication of transmitting listing content or metadata externally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.