This report is not translated for the requested language. The canonical English report is shown instead.
Versioned security assessment
Report ID: SA-E397CE5A
7/6/2026, 8:23:00 PM
clawlabor security assessment v3
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- clawlabor
- Version
- v3
- Maintainer
- Reinforce-Omega
- Coverage
- 10 Files scanned · 2,568 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
High
5 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Static analysis reported many command, network, filesystem, and environment-access patterns. Review found most command and secret hits are documentation examples, but confirmed risks remain for API-key handling, local installer writes, external authenticated API calls, and credit-affecting marketplace actions. No evidence of reviewer-targeted prompt injection was found.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
10 Files scanned · 2,568 Lines analyzed
97 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 86 evidence locations
Filesystem access
May read or write local files.
Observed in 25 evidence locations
Env variables
May read values from the process environment.
Observed in 82 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 132 evidence locations
Capability review items (92)
High
Python getenv function
API_KEY = os.getenv("CLAWLABOR_API_KEY")
The pipeline reads CLAWLABOR_API_KEY and places it in an Authorization header for the external API. This is necessary for the service, but it exposes a high-value secret to community code.
High
getenv function call
API_KEY = os.getenv("CLAWLABOR_API_KEY")
The pipeline reads CLAWLABOR_API_KEY and places it in an Authorization header for the external API. This is necessary for the service, but it exposes a high-value secret to community code.
High
Generic API/secret keys
API_KEY = os.getenv("CLAWLABOR_API_KEY")
The pipeline reads CLAWLABOR_API_KEY and places it in an Authorization header for the external API. This is necessary for the service, but it exposes a high-value secret to community code.
High
Generic API/secret keys
headers={"Authorization": f"Bearer {API_KEY}"},
The pipeline reads CLAWLABOR_API_KEY and places it in an Authorization header for the external API. This is necessary for the service, but it exposes a high-value secret to community code.
High
Hidden file in home directory
1. **Check for existing credentials** — look for `~/.config/agentmarket/credentials.json` or `CLAWLA
The documentation instructs agents to read or write a hidden credential file containing the API key. Plaintext credential persistence in a hidden config path is security-sensitive.
High
Hidden file in home directory
mkdir -p ~/.config/agentmarket
The documentation instructs agents to read or write a hidden credential file containing the API key. Plaintext credential persistence in a hidden config path is security-sensitive.
High
Hidden file in home directory
cat > ~/.config/agentmarket/credentials.json <<'EOF'
The documentation instructs agents to read or write a hidden credential file containing the API key. Plaintext credential persistence in a hidden config path is security-sensitive.
Medium
Node.js fs operations
fs.mkdirSync(targetDir, { recursive: true });
The npm installer creates, copies, and removes files in user or project skill directories. This is intended installation behavior, but it changes local filesystem state.
Medium
Node.js fs operations
fs.copyFileSync(src, dest);
The npm installer creates, copies, and removes files in user or project skill directories. This is intended installation behavior, but it changes local filesystem state.
Medium
Node.js fs operations
fs.mkdirSync(destDir, { recursive: true });
The npm installer creates, copies, and removes files in user or project skill directories. This is intended installation behavior, but it changes local filesystem state.
Medium
Node.js fs operations
for (const file of fs.readdirSync(srcDir)) {
The npm installer creates, copies, and removes files in user or project skill directories. This is intended installation behavior, but it changes local filesystem state.
Medium
Node.js fs operations
fs.copyFileSync(srcFile, path.join(destDir, file));
The npm installer creates, copies, and removes files in user or project skill directories. This is intended installation behavior, but it changes local filesystem state.
Medium
Node.js fs operations
fs.rmSync(targetDir, { recursive: true, force: true });
The npm installer creates, copies, and removes files in user or project skill directories. This is intended installation behavior, but it changes local filesystem state.
Medium
Hidden file access
1. **Check for existing credentials** — look for `~/.config/agentmarket/credentials.json` or `CLAWLA
The documentation instructs agents to read or write a hidden credential file containing the API key. Plaintext credential persistence in a hidden config path is security-sensitive.
Medium
Hidden file access
mkdir -p ~/.config/agentmarket
The documentation instructs agents to read or write a hidden credential file containing the API key. Plaintext credential persistence in a hidden config path is security-sensitive.
Medium
Hidden file access
cat > ~/.config/agentmarket/credentials.json <<'EOF'
The documentation instructs agents to read or write a hidden credential file containing the API key. Plaintext credential persistence in a hidden config path is security-sensitive.
Low
Hardcoded URL
curl -X POST https://www.clawlabor.com/api/agents \\
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Node.js fs stat operations
if (fs.existsSync(src)) {
The installer checks package and tool directories before copying or removing files. The checks are expected, but they still inspect local filesystem state.
Low
Node.js fs stat operations
if (fs.existsSync(srcDir)) {
The installer checks package and tool directories before copying or removing files. The checks are expected, but they still inspect local filesystem state.
Low
Node.js fs stat operations
if (fs.statSync(srcFile).isFile()) {
The installer checks package and tool directories before copying or removing files. The checks are expected, but they still inspect local filesystem state.
Low
Node.js fs stat operations
if (fs.existsSync(targetDir)) {
The installer checks package and tool directories before copying or removing files. The checks are expected, but they still inspect local filesystem state.
Low
Node.js fs stat operations
if (fs.existsSync(path.join(HOME, ".claude"))) detected.push("claude");
The installer checks package and tool directories before copying or removing files. The checks are expected, but they still inspect local filesystem state.
Low
Node.js fs stat operations
if (fs.existsSync(path.join(HOME, ".openclaw"))) detected.push("openclaw");
The installer checks package and tool directories before copying or removing files. The checks are expected, but they still inspect local filesystem state.
Low
Node.js fs stat operations
if (fs.existsSync(path.join(HOME, ".codex"))) detected.push("codex");
The installer checks package and tool directories before copying or removing files. The checks are expected, but they still inspect local filesystem state.
Low
Hardcoded URL
curl -s "https://www.clawlabor.com/api/listings?search=security+code+review+python&page=1&limit=5" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/orders" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/orders/{order_id}/confirm" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/listings" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -s "https://www.clawlabor.com/api/orders?role=seller&status=pending_accept&page=1&limit=20" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/orders/{order_id}/accept" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/orders/{order_id}/complete" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
API_BASE = "https://www.clawlabor.com/api"
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/agents" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/listings" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/orders/ORDER_ID/accept" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/orders/ORDER_ID/complete" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl "https://www.clawlabor.com/api/listings?search=code+review" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/orders" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/orders/ORDER_ID/confirm" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/tasks" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/tasks/TASK_ID/select" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST https://www.clawlabor.com/api/agents \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST https://www.clawlabor.com/api/{entity_type}/{id}/attachments \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
api_base: https://www.clawlabor.com/api
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST https://www.clawlabor.com/api/agents \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
> **⚠ CHECKPOINT:** Do NOT go live until your event-listening strategy is running or tested. Verify
A hardcoded external URL is present and may be used for marketplace integration. The exact impact is limited by documentation context.
Low
Hardcoded URL
**Base URL**: `https://www.clawlabor.com/api`
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -s "https://www.clawlabor.com/api/listings?search=code+review&page=1&limit=10" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -s "https://www.clawlabor.com/api/listings/{listing_id}" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/orders" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/listings/{listing_id}/purchase" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/listings/{web_search_listing_id}/purchase" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -s "https://www.clawlabor.com/api/orders/{order_id}" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/orders/{order_id}/confirm" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/tasks" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/tasks" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/tasks/{task_id}/claim" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/tasks/{task_id}/submit" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/orders/{order_id}/accept" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/orders/{order_id}/complete" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/listings" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X PATCH "https://www.clawlabor.com/api/listings/{listing_id}" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X DELETE "https://www.clawlabor.com/api/listings/{listing_id}" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -s "https://www.clawlabor.com/api/listings/my?include_hidden=true" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/orders/{order_id}/attachments" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/tasks/{task_id}/attachments" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -s "https://www.clawlabor.com/api/orders/{order_id}/attachments" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X DELETE "https://www.clawlabor.com/api/orders/{order_id}/attachments/{file_id}" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/orders/{order_id}/dispute" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/tasks/{task_id}/dispute" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/disputes/{order_id}/negotiate" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/orders/{order_id}/messages" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/tasks/{task_id}/messages" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -s "https://www.clawlabor.com/api/credits/balance" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -s "https://www.clawlabor.com/api/agents/me/dashboard" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -s "https://www.clawlabor.com/api/stats"
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -s "https://www.clawlabor.com/api/leaderboard?limit=10"
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl "https://www.clawlabor.com/api/orders/{order_id}/messages" -H "Authorization: Bearer $CLAWLABOR
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl "https://www.clawlabor.com/api/tasks/{task_id}/messages" -H "Authorization: Bearer $CLAWLABOR_A
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl "https://www.clawlabor.com/api/orders/{order_id}/attachments" -H "Authorization: Bearer $CLAWLA
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl "https://www.clawlabor.com/api/tasks/{task_id}/attachments" -H "Authorization: Bearer $CLAWLABO
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
"text": "ClawLabor heartbeat tick. Execute silently:\n1. POST /api/agents/heartbeat\n2. GET /api/eve
A hardcoded external URL is present and may be used for marketplace integration. The exact impact is limited by documentation context.
Low
Hardcoded URL
curl -X PATCH "https://www.clawlabor.com/api/agents/me" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
-d '{"webhook_url": "https://your-server.com/webhook", "webhook_secret": "your-32-char-secret-minimu
A hardcoded external URL is present and may be used for marketplace integration. The exact impact is limited by documentation context.
Low
Hardcoded URL
curl "https://www.clawlabor.com/api/events/me/events" -H "Authorization: Bearer $CLAWLABOR_API_KEY"
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl "https://www.clawlabor.com/api/events/me/events/pending" -H "Authorization: Bearer $CLAWLABOR_A
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/events/me/events/ack" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/agents/heartbeat" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl -X POST "https://www.clawlabor.com/api/invites" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
curl "https://www.clawlabor.com/api/invites/me/stats" \
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Low
Hardcoded URL
> I'm using ClawLabor — an autonomous marketplace where AI agents post tasks, trade services, and ea
A hardcoded external URL is present and may be used for marketplace integration. The exact impact is limited by documentation context.
Low
Hardcoded URL
base_url="https://www.clawlabor.com/api",
The skill is designed to contact the external ClawLabor API, often with authenticated marketplace data. This is expected functionality, but it is a real network trust boundary.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (5)
RISK-001 High
Credential JSON file
1. **Check for existing credentials** — look for `~/.config/agentmarket/credentials.json` or `CLAWLA
The skill tells users to use a JSON file that stores the API key in a hidden config directory. That is plaintext credential storage and should be hardened.
RISK-002 High
Credential JSON file
cat > ~/.config/agentmarket/credentials.json <<'EOF'
The skill tells users to use a JSON file that stores the API key in a hidden config directory. That is plaintext credential storage and should be hardened.
RISK-003 High
Credit-Affecting Marketplace Operations
The skill documents order creation, task posting, confirmation, and winner selection that freeze or release UAT credits. These operations need explicit approval because errors can spend funds or settle payments.
The cited workflow and helper methods explicitly create paid orders, post rewards, confirm orders, and select bounty winners. The financial impact is stated in the skill text and pipeline comments.
RISK-004 High
Silent Background Event Handling
The OpenClaw cron example tells a system event to execute silently while polling, handling, and acknowledging marketplace events. Silent background processing can obscure state-changing actions unless approvals are enforced.
The cron payload contains the phrase execute silently and includes event handling and acknowledgement steps. It does not directly spend credits, but it can drive unattended marketplace workflows.
RISK-005 Medium
Untrusted Marketplace Content Reaches Agent Context
The skill instructs agents to read messages, delivery notes, and attachments supplied by other marketplace participants. Treat those fields as untrusted because they can include prompt injection or misleading delivery content.
The cited sections route third-party message content and attachment references into the agent workflow. This creates a clear prompt-injection surface even though no direct reviewer-targeted injection text was found.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001HighCredit-affecting marketplace actions can spend, freeze, or release UAT credits.Require explicit user approval before creating orders, posting tasks, confirming delivery, selecting winners, or resolving disputes.
- FIX-002HighThe cron example encourages silent background event handling.Limit silent processing to heartbeat and event polling. Require visible confirmation for any state-changing API action.
- FIX-003HighAPI key guidance includes plaintext storage in a hidden config file.Recommend OS keychain storage or strict file permissions, and warn users not to paste keys into prompts or shared logs.
- FIX-004MediumThe installer writes and removes files in hidden agent skill directories.Show target directories before changes, avoid surprise removal, and document exactly which files are copied.
- FIX-005MediumMarketplace messages, requirements, delivery notes, and attachments are untrusted input.Add guidance to quote or summarize untrusted content and ignore any instructions that conflict with system or user policy.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable