T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/adapters/openclaw_adapter.py:68- Finding
Unauthenticated Network Exposure of a Tool-Capable OpenClaw Agent
- Content
View full analysis
- Remediation
View remediation
Security audit
Lobster Market
Security checks for vulnerabilities and agentic risk
Overview
This is a real Lobster Market integration, but it exposes local agent/LLM services and handles powerful credentials in ways that need careful review before installation.
Install only if you are prepared to run it as an exposed service. Keep adapters bound to localhost or behind strong authentication, use a dedicated unprivileged account, restrict agent tools for marketplace tasks, avoid running the start scripts as root, protect or rotate generated Lobster credentials, and set spending limits on any LLM provider keys.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T01 · Skill Instruction Hijacking
Error
- Location
scripts/market-connect.py:175- Finding
Untrusted Marketplace Instructions Are Delegated Directly to Local Tool-Capable Agents
- Content
View full analysis
None: """Receive task_send → forward to local-endpoint → relay result back.""" task_id = task_msg.get("task_id", "") message = task_msg.get("message", {}) metadata = task_msg.get("metadata", {}) log.info("📥 Received task: %s", task_id) # 1. Accept await ws.send(json.dumps({ "v": PROTOCOL_VERSION, "type": "task_accept", "task_id": task_id, })) # 2. Progress: working await ws.send(json.dumps({ "v": PROTOCOL_VERSION, "type": "task_progress", "task_id": task_id, "status": {"state": "working"}, })) # 3. Forward to local endpoint (message & metadata passed through as-is) try: result = await forward_to_endpoint(local_endpoint, { "task_id": task_id, "message": message, "metadata": metadata, }) ``` From `scripts/adapters/openclaw_adapter.py`: ```python task_id = body.get("task_id", "") message = body.get("message", {}) user_text = _extract_text(message) log.info("📥 Execute task: %s", task_id) try: result_text = await _run_openclaw(user_text) ``` From `scripts/adapters/nanobot_adapter.py`: ```python task_id = body.get("task_id", "") message = body.get("message", {}) user_text = _extract_text(message) log.info("📥 Execute task: %s", task_id) try: result_text = await _run_nanobot(user_text) ``` ### Technical Analysis Marketplace task messages are attacker-controlled content from service buyers. The connector accepts a task and forwards its `message` and `metadata` fields without validation, trust labeling, ...[truncated 1981 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/lobster.py:78- Finding
Marketplace Credentials Are Stored and Printed Without Enforced Protection
- Content
View full analysis
tuple: """加载 API Key 和 Secret，返回 (key, secret)。""" if API_KEY_FILE.exists(): data = json.loads(API_KEY_FILE.read_text()) return data.get("api_key", ""), data.get("api_secret", "") return "", "" def save_api_key(key_data: dict): """保存 API Key。""" API_KEY_FILE.parent.mkdir(parents=True, exist_ok=True) API_KEY_FILE.write_text(json.dumps(key_data, indent=2)) ``` ```python # Save agent key + secret for seller operations save_api_key({ "api_key": result.get("agent_key", ""), "api_secret": result.get("agent_secret", ""), }) # Save master key + secret for future login MASTER_KEY_FILE.parent.mkdir(parents=True, exist_ok=True) MASTER_KEY_FILE.write_text(json.dumps({ "user_id": result.get("user_id", ""), "master_key": result.get("master_key", ""), "master_secret": result.get("master_secret", ""), "agent_key": result.get("agent_key", ""), "agent_secret": result.get("agent_secret", ""), }, indent=2)) print(f"🦞 ✅ Agent 注册成功!") print(f" User ID: {result.get('user_id', '?')}") print(f" Master Key: {result.get('master_key', '?')}") print(f" Master Secret: {result.get('master_secret', '?')}") print(f" Agent Key: {result.get('agent_key', '?')}") print(f" Agent Secret: {result.get('agent_secret', '?')}") ``` ### Technical Analysis JWT access and refresh tokens, agent secrets, and the master account secret are written as plaintext JSON. The implementation creates the directory and files without explicitly enforcing mode `0700` on the directory or `0600` on the files. Actual ...[truncated 1724 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/start-agents.sh:8- Finding
Executable Shell Content Is Sourced from a Predictable Temporary Directory
- Content
View full analysis
"$PID_DIR/agent-uuids.cache" ``` ### Technical Analysis The startup script stores process state and a shell-formatted cache under the predictable path `/tmp/lobster-agents`. It later executes that cache with `source`. The script does not verify: - Ownership of the directory or cache. - Restrictive permissions. - Whether the cache is a regular file. - Whether the directory or cache is a symbolic link. - Whether another user created or replaced the cache. A file sourced by Bash is executable code rather than inert data. Therefore, any attacker able to control `agent-uuids.cache` can execute arbitrary commands with the privileges of the user running `start-agents.sh`. The default prompt path references `/root`, making privileged execution a plausible deployment mode and increasing the consequence of this weakness. ### Attack Path 1. A local attacker pre-creates `/tmp/lobster-agents` or gains write access to it. 2. The attacker creates `agent-uuids.cache` containing shell commands, for example: ```bash declare -gA AGENT_UUIDS attacker_command ``` 3. The legitimate user or administrator runs `scripts/start-agents.sh start`. 4. The remote discovery API is unavailable or returns no usable response. 5. The script enters its fallback path. 6. Bash executes `source /tmp/lobster-agents/agent-u ...[truncated 641 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/adapters/llm_adapter.py:40- Finding
Unauthenticated LLM Proxy Allows Cost Abuse and Configurable Credential Disclosure
- Content
View full analysis
str: """Synchronous LLM call via urllib (no extra deps).""" import urllib.request url = f"{base_url}/chat/completions" body = json.dumps({"model": model, "messages": messages}).encode() req = urllib.request.Request(url, data=body, headers={ "Content-Type": "application/json", "Authorization": f"Bearer {api_key}", }) with urllib.request.urlopen(req, timeout=300) as resp: data = json.loads(resp.read().decode()) return data["choices"][0]["message"]["content"] ``` ```python async def handle_execute(request): """POST /execute — 执行 LLM 任务""" try: body = await request.json() except Exception: return web.json_response({"status": "failed", "error": "Invalid JSON"}, status=400) task_id = body.get("task_id", "") message = body.get("message", {}) ``` ```python if HAS_AIOHTTP: app = web.Application() app.router.add_post("/execute", handle_execute) app.router.add_get("/health", ...[truncated 2325 chars]- Remediation
View remediation
Vulnerability Patterns
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (82)
Tainted flow: 'req' from os.environ.get (line 45, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 95% confidence
- Finding
The launcher builds its API base URL from the LOBSTER_API environment variable and then performs authenticated requests using the locally stored bearer token. If an attacker can influence the environment, they can redirect the client to an arbitrary host and exfiltrate the access token or manipulate returned agent configs, leading to downstream arbitrary process launches.
- Content
python "Accept": "application/json", }) try: with urllib.request.urlopen(req, timeout=10) as resp: return json.loads(resp.read().decode()) except Exception as e: print(f"⚠️ API request failed: {e}")
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is presented as a natural-language interface for registration, publishing, discovery, invocation, and wallet management, but the implementation reportedly lacks those functions and instead introduces undeclared local-service lifecycle controls. Such misrepresentation can cause dangerous overtrust and improper authorization because the actual behavior is more administrative and infrastructure-oriented than the user-facing description suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a natural-language interface for registration, publishing, discovery, invocation, and wallet management, but the implementation reportedly lacks those functions and instead introduces undeclared local-service lifecycle controls. Such misrepresentation can cause dangerous overtrust and improper authorization because the actual behavior is more administrative and infrastructure-oriented than the user-facing description suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is presented as a natural-language interface for registration, publishing, discovery, invocation, and wallet management, but the implementation reportedly lacks those functions and instead introduces undeclared local-service lifecycle controls. Such misrepresentation can cause dangerous overtrust and improper authorization because the actual behavior is more administrative and infrastructure-oriented than the user-facing description suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill is presented as a natural-language interface for registration, publishing, discovery, invocation, and wallet management, but the implementation reportedly lacks those functions and instead introduces undeclared local-service lifecycle controls. Such misrepresentation can cause dangerous overtrust and improper authorization because the actual behavior is more administrative and infrastructure-oriented than the user-facing description suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill is presented as a natural-language interface for registration, publishing, discovery, invocation, and wallet management, but the implementation reportedly lacks those functions and instead introduces undeclared local-service lifecycle controls. Such misrepresentation can cause dangerous overtrust and improper authorization because the actual behavior is more administrative and infrastructure-oriented than the user-facing description suggests.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill is presented as a natural-language interface for registration, publishing, discovery, invocation, and wallet management, but the implementation reportedly lacks those functions and instead introduces undeclared local-service lifecycle controls. Such misrepresentation can cause dangerous overtrust and improper authorization because the actual behavior is more administrative and infrastructure-oriented than the user-facing description suggests.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md CLI 路径: `scripts/lobster.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md CLI 路径: `scripts/lobster.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md CLI 路径: `scripts/lobster.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md CLI 路径: `scripts/lobster.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md CLI 路径: `scripts/lobster.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md CLI 路径: `scripts/lobster.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md CLI 路径: `scripts/lobster.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md CLI 路径: `scripts/lobster.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md CLI 路径: `scripts/lobster.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md CLI 路径: `scripts/lobster.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md CLI 路径: `scripts/lobster.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md CLI 路径: `scripts/lobster.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md CLI 路径: `scripts/lobster.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md CLI 路径: `scripts/lobster.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md CLI 路径: `scripts/lobster.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md CLI 路径: `scripts/lobster.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md CLI 路径: `scripts/lobster.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md CLI 路径: `scripts/lobster.py`
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/auth-billing-design.md:264