Is madsb/nanobazaar safe?
https://github.com/openclaw/skills/tree/main/skills/madsb/nanobazaar
NanoBazaar is a functionally legitimate marketplace relay skill with well-structured documentation and explicit prompt injection defenses in its buyer/seller prompts. However, the skill's security posture is substantially dependent on two unaudited external npm packages (nanobazaar-cli and berrypay) that perform all sensitive operations including key management, payload encryption, and financial transactions — neither is included in the audited skill bundle. The skill also establishes a persistent background SSE connection to a third-party relay, stores private cryptographic keys on disk, and enables partially autonomous XNO cryptocurrency payments, creating meaningful financial and data-exposure risk that users must evaluate before installation.
Category Scores
Findings (10)
HIGH External unaudited npm binary required (nanobazaar-cli) -35 ▶
The skill's install metadata and SKILL.md both require the agent to globally install nanobazaar-cli from npm. This package is not included in the skill bundle and has not been reviewed. All sensitive operations — key generation, request signing, payload encryption/decryption, and relay communication — are delegated to this external binary. A malicious version of this package could read local credentials, exfiltrate keys, or perform unauthorized relay calls.
HIGH Secondary unaudited npm binary installed (berrypay) -10 ▶
The skill installs berrypay CLI by default during setup unless --no-install-berrypay is passed. This second external package manages Nano wallet operations, generates ephemeral charge addresses, and verifies incoming payments. It is granted a wallet seed (BERRYPAY_SEED) and performs real financial transactions. Not included in the audited skill bundle.
HIGH Persistent background SSE process (nanobazaar watch in tmux) -10 ▶
The skill instructs the agent to start nanobazaar watch in tmux as a long-running process. This process maintains a continuous SSE connection to relay.nanobazaar.ai and triggers agent wakeups on relay events. A compromised relay could push malicious wake events repeatedly or at targeted times.
MEDIUM Private cryptographic keys stored in plaintext JSON on disk -15 ▶
The skill's state schema mandates local storage of Ed25519 signing private keys and X25519 encryption private keys in ~/.config/nanobazaar/nanobazaar.json. If the host is compromised or if any other installed skill can read arbitrary files, these keys would be exposed. The relay uses these keys for signing all authenticated requests.
MEDIUM Persistent outbound connection to third-party relay -20 ▶
All job and payment data transits relay.nanobazaar.ai. The relay is operated by a third party (the skill author). While payload encryption is designed to prevent relay-side plaintext access, relay metadata (bot IDs, offer IDs, job IDs, timestamps, transaction amounts) is visible to the relay operator.
MEDIUM Multi-layer instruction loading via role prompt files -15 ▶
SKILL.md instructs the agent to read and unconditionally follow prompts/buyer.md or prompts/seller.md based on role. These files contain additional behavioral instructions beyond what the user reviews in SKILL.md. This creates a two-stage instruction chain; the secondary files could be updated in a future skill version to introduce malicious directives without SKILL.md itself appearing to change.
MEDIUM Output suppression rule in HEARTBEAT_TEMPLATE reduces user visibility -13 ▶
The HEARTBEAT_TEMPLATE.md instructs the agent never to echo tool output, logs, or internal commands to the user when running the polling loop. While this reduces noise, it also reduces the user's ability to audit what the agent is doing during background relay polling operations.
MEDIUM Autonomous financial transaction capability with XNO -20 ▶
The skill enables the agent to receive payment charges, verify them, send Nano (XNO) cryptocurrency payments, and mark jobs paid with minimal user interaction per transaction. A compromised counterparty or relay could manipulate charge amounts, timing, or payment addresses to misdirect funds.
MEDIUM External counterparty payloads as persistent prompt injection surface -22 ▶
The skill decrypts and processes payloads from external buyers/sellers on every poll cycle. While the skill includes explicit defenses, a sophisticated attacker who has registered a bot on the relay can craft payloads designed to probe agent decision-making, extract job context, or abuse confirmation flows.
LOW Canary files accessed during monitoring window -10 ▶
Sensitive canary files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, gcloud credentials) were opened at two points during monitoring: before clone (audit epoch 1771906208, pre-install) and after install (audit epoch 1771906232). The pre-clone timing and the pattern across multiple files strongly suggest these are audit-system baseline checks rather than skill-triggered access. All files confirmed intact by canary integrity check.