agent execution market

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:35 AM UTC
• Version: 1.0.0

Overview

The skill is coherent but should be reviewed because it points users to install unaudited external code and describes autonomous financial/key-based operations without enough safety boundaries.

Review this before installing. Use a pinned package version, avoid sudo/global installation where possible, verify package provenance, and test in a sandbox or testnet first. Do not use real funds, broad token approvals, or sensitive API data until you understand how solvers are selected, what they can execute, where keys are stored, and what confirmation or spending limits are enforced.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: readme.md:45
• Finding: Unpinned Global Installation of an Unaudited Third-Party Package## Vulnerability Details **File Location**: `readme.md`, lines 45-50 **Vulnerability Type**: Supply-chain exposure through a mutable, globally installed npm dependency **Risk Level**: Medium **Code Snippet**: ```bash # Global installation npm install -g openclaw-agent-execution-market # Verify installation aem --version ``` ### Technical Analysis The documentation instructs users to install `openclaw-agent-execution-market` globally without pinning an exact version or verifying package integrity. Consequently, the installed package can differ from the version that was available when this Skill was reviewed. The audited project contains only `readme.md` and `skill.md`; it does not contain the npm package implementation, a lockfile, integrity metadata, or lifecycle-script definitions. The audit therefore cannot verify the installed package's code, network activity, installation hooks, key handling, or command behavior. npm packages can execute lifecycle scripts during installation. A compromised maintainer account, malicious future release, or registry compromise could therefore cause attacker-controlled code to execute under the installing user's account. Global installation unnecessarily increases the package's reach by exposing commands system-wide for that user. The static pre-scan warning concerning transmission of sensitive information was also reviewed. The available files contain documentation links, example public API addresses, and a localhost solver endpoint, but no implementation that directly collects or transmits private keys, credentials, environment variables, or agent state. Direct data exfiltration is therefore not confirmed from this artifact. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or a future package release. 2. The attacker publishes a malicious version containing an installation lifecycle script or malicious CLI implementation. 3. A user follows the unp ...[truncated 1400 chars]
• Remediation: ## Remediation Suggestions 1. Pin the dependency to a reviewed, immutable version instead of installing the latest release: ```bash npm install --global --ignore-scripts openclaw-agent-execution-market@0.1.0 ``` 2. Publish and verify the expected npm integrity digest or signed release provenance before installation. 3. Include the actual package source, manifest, lockfile, and lifecycle scripts in the review artifact. 4. Prefer a project-local installation over a global installation: ```bash npm install --save-exact --ignore-scripts openclaw-agent-execution-market@0.1.0 ``` 5. Disable lifecycle scripts by default. If scripts are required, document their purpose and provide their complete auditable source. 6. Run the package as a non-privileged user and avoid `sudo` or administrator installation. 7. Store generated private keys with restrictive filesystem permissions and prevent the CLI from sending them to marketplace or solver endpoints. 8. Document all expected outbound destinations and require explicit user confirmation before transmitting intent data that may contain financial, wallet, or personal information. 9. Add dependency monitoring, publisher-account multifactor authentication, provenance attestations, and a release-review process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

External Transmission

Medium

• Category: Data Exfiltration

Content

# Submit an intent
aem intent submit \
  --type "data-fetch" \
  --params '{"url":"https://api.example.com/data"}' \
  --max-fee 100

# Register as a solver

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Submit an intent
aem intent submit \
  --type "data-fetch" \
  --params '{"url":"https://api.example.com/data"}' \
  --max-fee 100

# Register as a solver

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README promotes autonomous DeFi optimization, cross-chain transfers, data aggregation, and AI inference as solver-driven operations without any visible warnings about financial loss, bad solver behavior, unsafe prompts, transaction finality, approval scope, or the need for human review. In an agent-execution marketplace context, describing impactful autonomous actions as straightforward examples can encourage unsafe deployment and misuse, especially where solvers may act on user assets or external systems.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill advertises CLI key generation and management capabilities but does not warn users about secure storage, non-exportability, passphrase protection, rotation, or the risk of exposing private keys in shells, logs, or automation scripts. In an agent-execution marketplace where keys authorize intents, bids, and solver actions, weak user guidance can lead to credential compromise and unauthorized operations even if the underlying cryptography is sound.

Static analysis

No suspicious patterns detected.