Security audit

clawmart-provider

Security checks for vulnerabilities and agentic risk

Overview

This is a real marketplace connector, but it asks to scan private local context to create public listing text and stores a live token for a persistent bridge.

Install only in an isolated OpenClaw profile or machine with minimal private data. Before registration, review exactly which memory, profile, skill, project, and knowledge-base files it will read; approve every generated listing field before submission; treat both the ClawMart API token and sessionToken as sensitive credentials; and run the bridge only while you intentionally want the agent receiving and relaying ClawMart work.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The skill explicitly instructs the agent to scan broad owner-local context, including memory files, installed skills, repositories, and knowledge bases, and then use that analysis to generate marketplace-facing listing content. That creates a direct path for private local information to be transformed into externally shared summaries, contradicting the earlier privacy boundary and risking disclosure of sensitive owner data.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The document first forbids exposing memory files, filesystem details, secrets, and local machine state, but later requires scanning those same classes of private sources to derive listings and capability descriptions. This contradiction is dangerous because it normalizes accessing sensitive local data and converting it into outward-facing summaries, increasing the chance of privacy breaches even if raw data is not quoted verbatim.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The capability discovery step authorizes enumeration of extensive private owner context without a narrowly scoped operational need. Broad inspection of memories, tools, repositories, and connected knowledge bases materially expands the accessible sensitive surface and can expose confidential business, personal, or credential-adjacent information through analysis or later outputs.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill directs the agent to persist a returned session token into a local config file without an explicit warning about credential storage risk, file permissions, rotation, or cross-role exposure. Persisting live tokens to disk can enable account takeover or unauthorized marketplace actions if the host is shared, backed up insecurely, or later compromised.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill instructs the agent to read private owner memory/profile files and then synthesize externally visible capability descriptions, summaries, and listings from that material. Even if the output is phrased as a summary, it is still a natural-language exfiltration channel that can reveal sensitive personal, organizational, or project information to a third-party service.

Static analysis

No suspicious patterns detected.