Ai Intelligent Ai Model Marketplace

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:24 AM UTC
• Version: 1.0.3

Overview

The skill is a plausible AI model marketplace, but it asks users to install and run mutable remote code for high-impact marketplace and deployment functions without enough scoping or safety disclosure.

Review this before installing. Only run it in an isolated environment after checking the referenced GitHub repository, its dependency list, and any payment, deployment, and settlement settings. Do not connect production credentials, billing accounts, model assets, or infrastructure until the executed code and dependencies are pinned and verified.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:42

Finding

Mutable Remote Payload and Unverified Dependency Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42-48
Vulnerability Type: Remote payload retrieval and insecure dependency execution
Risk Level: High

bash

## Installation
```bash
git clone https://github.com/openclaw-skills/ai-intelligent-ai-model-marketplace
cd ai-intelligent-ai-model-marketplace
pip install -r requirements.txt
python app.py

text

### Technical Analysis

The installation procedure clones a remote repository without pinning it to a reviewed commit, signed tag, or immutable release artifact. It then installs dependencies from an unreviewed `requirements.txt` and directly executes the downloaded `app.py`.

The local project contains no copy of the referenced application or dependency manifest. Therefore, neither the effective application payload nor its dependencies can be verified by auditing this package. The remote repository can change after the Skill has been reviewed, making the instructions an execution channel for a mutable external payload.

The `pip install` step also introduces supply-chain exposure. Dependencies may execute build or installation logic, and the instructions provide no evidence of exact version pins, cryptographic hashes, trusted package indexes, or provenance verification.

### Attack Path

1. An attacker compromises the referenced repository, a maintainer account, or one of its dependencies.
2. The attacker modifies `app.py`, `requirements.txt`, or a dependency release to include malicious code.
3. A user follows the installation commands in `SKILL.md`.
4. `git clone` retrieves the attacker-controlled current repository state.
5. `pip install -r requirements.txt` installs the unverified dependency set and may execute malicious package installation or build logic.
6. `python app.py` executes the mutable remote application directly.
7. The payload runs with the privileges and environmental access of the user who invoked the commands.

### Impa
...[truncated 675 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete executable source and dependency manifests in the audited Skill package so that the reviewed content is the content users execute.
2. If remote retrieval is unavoidable, pin the repository to a specific reviewed commit hash rather than cloning the mutable default branch.
3. Distribute signed release artifacts and verify their cryptographic signatures or checksums before installation or execution.
4. Pin every Python dependency to an exact reviewed version and require hashes, such as through a lock file or pip install --require-hashes.
5. Restrict package installation to explicitly trusted indexes and review all direct and transitive dependencies for dependency-confusion and typosquatting risks.
6. Perform installation and execution inside an isolated, least-privilege virtual environment or container with minimal filesystem, credential, and network access.
7. Separate retrieval, verification, dependency installation, and execution into distinct documented steps. Do not execute app.py until integrity and provenance checks succeed.
8. Add reproducible build information and document the reviewed commit and dependency set in SKILL.md.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file describes potentially safety-relevant behaviors such as online model transactions, one-click deployment, and automatic settlement, but provides no warning about effects on user data, infrastructure, costs, or account actions. Under the markdown-specific SQP-2 criteria, descriptions of behaviors that may affect privacy, user data, or system integrity should disclose those risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description and the full markdown content are written in Chinese, and there is no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. This can constitute a language/locale policy issue when a skill implicitly forces one language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.