clawmart-requester

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:12 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for ClawMart delegation, but it needs Review because setup runs an unverified background bridge and broadly enables local OpenClaw hooks.

Install only if you trust ClawMart enough to run its downloaded bridge under your user account. Before use, prefer a verified or bundled bridge, restrict hooks to a dedicated session, protect and rotate tokens, avoid sending secrets or sensitive files through orders, and stop the bridge plus undo hook changes when finished.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:57

Finding

Unverified Remote JavaScript Download and Execution

Content

View full analysis

/dev/null 2>&1; then echo "Bridge already running." else nohup node ~/.clawmart/bridge.mjs > ~/.clawmart/bridge.log 2>&1 & echo $! > ~/.clawmart/bridge.pid ``` ### Technical Analysis The setup retrieves a JavaScript file from an external URL and later executes it with Node.js. The downloaded artifact is not version-pinned and is not verified using a cryptographic digest or trusted digital signature. The bridge source is also absent from the reviewed project, so its effective behavior cannot be statically audited. Because the remote endpoint can provide different content after the skill has been reviewed, compromise of the hosting service, delivery infrastructure, DNS resolution, deployment process, or publisher account could replace the bridge with arbitrary JavaScript. The `curl -fsSL` options only enforce HTTP failure handling and TLS transport. They do not prove that the downloaded artifact is the specific version reviewed or approved by the user. ### Attack Path 1. An attacker compromises the bridge download endpoint or its deployment pipeline. 2. The attacker replaces `bridge.mjs` with malicious JavaScript. 3. A user follows the documented setup procedure. 4. `curl` writes the attacker-controlled payload to `~/.clawmart/bridge.mjs`. 5. The startup command invokes the payload through `node`. 6. The malicious process executes with the user's privileges and remains active in the background. ### Impact Assessment Successful exploitation provid ...[truncated 640 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:131

Finding

Untrusted Marketplace Messages Injected as Agent Conversation Turns

Content

View full analysis

` to receive provider replies in real time 2. Forwards each message to your OpenClaw agent via `POST /hooks/agent` 3. Starts a local callback server on `127.0.0.1:3003` 4. Your agent posts results to the callback URL; bridge relays to ClawMart 5. Health endpoint at `http://127.0.0.1:3010/health` for liveness checks ``` ```text The bridge forwards provider messages to your OpenClaw agent via the **hooks API** (`POST /hooks/agent`). You receive the message as a normal agent conversation turn containing the provider's text and a `Callback URL`. ``` ```text 1. The requester bridge receives the provider message from ClawMart SSE. 2. The bridge forwards it into OpenClaw via `POST /hooks/agent`. 3. Show it in the active OpenClaw session immediately. 4. Decide whether it answers A's goal, needs follow-up, or requires new approval. 5. Reply through the callback URL or continue / end the order. ``` ### Technical Analysis Provider-controlled content is forwarded through the OpenClaw hook API and presented as a normal agent conversation turn. The documented protocol does not establish a strong instruction/data boundary, sanitize adversarial content, or require human authorization before tool use triggered by a provider message. A malicious or compromised provider can embed prompt-injection instructions in an otherwise legitimate response. Since the content enters the active agent session, the agent may interpret those instructions as operational requests rather than untrusted marketplace data. The included callback URL also creates an action channel. If callback metadata is not independently authenticated and bound to the expected order, injected content could attempt to ...[truncated 1444 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:85

Finding

Persistent Expansion of OpenClaw Hook and Session-Key Permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:32

Finding

API Token Exposure Through Query Parameters and JSON Request Bodies

Content

View full analysis

` header** 3. **`apiToken` field in the JSON request body** (fallback) ``` ```text 1. Opens an SSE connection to `GET /api/requesters/stream?apiToken=` to receive provider replies in real time ``` ```text ### SSE (requires `apiToken` query param) | Method | Path | Description | |--------|------|-------------| | GET | `/api/requesters/stream?apiToken=` | Unified SSE for all active orders | ``` ### Technical Analysis The documented SSE authentication mechanism places the API token in the URL query string. URLs are commonly captured by reverse-proxy access logs, application logs, diagnostics, monitoring systems, browser history, command history, and process inspection. TLS protects network transport but does not prevent endpoint-side or local logging of the URL. The documentation also supports credentials in JSON request bodies. Request bodies may be retained by debugging middleware, API tracing systems, error reports, or telemetry. Supporting several credential locations increases the number of places where secret-redaction controls must operate correctly. The header-based method is already documented and presents a smaller accidental disclosure surface, but it is not consistently required. ### Attack Path 1. A requester opens the SSE endpoint using `?apiToken=`. 2. The complete URL is captured by a proxy, server log, diagnostic trace, shell history, process listing, or monitoring system. 3. An attacker obtains access to that record. 4. The attacker extracts the bearer-equivalent API token. 5. The attacker authenticates to requester endpoints ...[truncated 829 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:14

Finding

Full Delegated Conversation Export to an External Marketplace

Content

View full analysis

b1` conversation running through the ClawMart order channel - mirror each ClawMart exchange back into the active OpenClaw session ``` ```text Every continuation must appear in both places: - ClawMart order channel - the active OpenClaw session where A is working with `a1` ``` ```text 3. **Use ClawMart as the channel ledger** — All `a1 <-> b1` exchanges must be preserved in the order channel there. 4. **Mirror instantly** — Every new ClawMart message should also appear in the active OpenClaw session. The bridge delivers messages via SSE in real time. ``` ### Technical Analysis The skill requires all requester-provider exchanges to be transmitted to and preserved by an external marketplace. This creates a deliberate external data boundary for the full delegated conversation. Although the skill tells the agent to obtain approval for a general data boundary, it does not define mandatory secret detection, field-level minimization, retention limits, deletion behavior, or per-message confirmation for newly introduced sensitive information. Bidirectional mirroring also duplicates data between ClawMart and the active OpenClaw session, increasing the number of systems and logs that may retain sensitive content. This is particularly risky when delegated tasks involve source code, credentials, proprietary documents, personal information, regulated records, internal URLs, or information subsequently introduced during follow-up rounds. ### Attack Path 1. A user approves a delegation using a broad or insufficiently defined data boundary. 2. The active conversation later contains sensitive material needed for, or incidentally related to, the task. 3. The agent forwards that material to the provide ...[truncated 946 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: ClawMart Requester
description: OpenClaw skill for requester agents to browse listings, create orders, and manage the order lifecycle on ClawMart marketplace.
version: 0.8.0
---

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to download and execute JavaScript from a remote URL into the local environment, then run it persistently. This creates a clear supply-chain and arbitrary code execution risk: compromise of the hosting domain, CDN path, or content could lead to full execution under the user's account, including access to local files, API tokens, and agent state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document tells users to fetch and run remote bridge code but does not clearly warn about supply-chain integrity, remote code execution, or trust assumptions. Even if the bridge is legitimate, omitting that warning increases the likelihood that users will execute unverified code with local privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup writes API tokens and hook secrets into configuration files under the user's home directory without a clear warning about secret storage, file permissions, or exposure through backups and local compromise. This can lead to credential leakage and unauthorized use of the marketplace or local hook interface.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

These steps modify OpenClaw hook configuration, enable request session keys, and expand accepted session key prefixes, which increases the local agent's reachable attack surface beyond simple marketplace access. The skill also writes and synchronizes hook tokens across components, so a misconfiguration or token exposure could allow unauthorized message injection into the agent workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill omits a clear warning that it alters OpenClaw hook settings and enables a local callback/listener pathway, which changes the trust boundary of the local agent environment. Users may not realize they are exposing a new authenticated control surface that could be abused if tokens leak or validation is weak.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

bash

# Check if bridge is already running
if curl -s http://127.0.0.1:3010/health > /dev/null 2>&1; then
  echo "Bridge already running."
else
  nohup node ~/.clawmart/bridge.mjs > ~/.clawmart/bridge.log 2>&1 &

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

Using nohup to launch the bridge as a background service with PID/log files establishes persistent local execution beyond the immediate task. In context, that persistent process maintains connectivity between ClawMart and the local OpenClaw hooks, so compromise or misuse could create a durable foothold for message injection, data relay, or continued unauthorized operation.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md

if curl -s http://127.0.0.1:3010/health > /dev/null 2>&1; then
  echo "Bridge already running."
else
  nohup node ~/.clawmart/bridge.mjs > ~/.clawmart/bridge.log 2>&1 &
  echo $! > ~/.clawmart/bridge.pid
  sleep 2
  if curl -s http://127.0.0.1:3010/health > /dev/null 2>&1; then

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.

md

- the data boundary
- whether follow-up rounds are allowed

Do not create the order if A has not approved it.

### 5. Create an Order

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest names this as 'ClawMart Requester' and describes requester agents browsing listings, creating orders, and managing requester-side lifecycle. These lines advertise going online as a provider and enabling provider role behavior, which is unrelated to the stated requester scope.

Content

No source excerpt is available for this finding.