Arena Social

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:19 AM UTC
• Version: 1.0.0

Overview

This is a coherent Arena social API wrapper, but it needs Review because it grants broad authenticated social-account actions and has a search-input bug that can run local commands.

Review carefully before installing. Use only with an Arena account/API key you intend the agent to control, protect ARENA_API_KEY with restrictive file permissions, and treat posts, DMs, follows, reposts, likes, and profile edits as real account actions. The search-command injection should be fixed before use in any workflow that may receive untrusted or automated input.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: arena.sh:68

Finding

Arbitrary Python and OS Command Execution Through Search Query Injection

Content

View full analysis

Remediation

View remediation

&2 exit 2 fi ``` 2. Use the same data-not-code principle throughout the script. Construct JSON request bodies through a JSON serializer rather than interpolating identifiers into JSON strings. 3. Restrict the runtime account to the minimum filesystem and network permissions required. 4. Store the API key in a dedicated secret store or narrowly permissioned file rather than a general-purpose `.env` file. Ensure the file is readable only by its owner. 5. Add regression tests containing quotes, semicolons, newlines, command-like text, and Python syntax to verify that all search input is treated strictly as data. 6. Consider using `curl --get --data-urlencode "searchString=$1"` to avoid invoking a language interpreter solely for URL encoding. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Checking for and reading $HOME/clawd/.env is a credential-access behavior because it probes local storage for reusable secrets not supplied as direct command input. In a skill with social-account action capabilities, that credential access becomes especially dangerous because it can immediately enable authenticated remote actions.

Content

Scanner excerpt · arena.sh (reported line 6)May include surrounding context.

sh

# Load API key
if [ -z "${ARENA_API_KEY:-}" ]; then
  if [ -f "$HOME/clawd/.env" ]; then
    ARENA_API_KEY=$(grep '^ARENA_API_KEY=' "$HOME/clawd/.env" | cut -d= -f2-)
  fi
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The grep/cut command extracts ARENA_API_KEY directly from a local .env file, constituting active credential retrieval. This is dangerous because it turns the script into a ready-made mechanism for leveraging locally stored secrets to perform external authenticated operations without any additional user approval.

Content

Scanner excerpt · arena.sh (reported line 7)May include surrounding context.

sh

# Load API key
if [ -z "${ARENA_API_KEY:-}" ]; then
  if [ -f "$HOME/clawd/.env" ]; then
    ARENA_API_KEY=$(grep '^ARENA_API_KEY=' "$HOME/clawd/.env" | cut -d= -f2-)
  fi
fi

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · arena.sh (reported line 24)May include surrounding context.

sh

local args=(-s -X "$method" "$BASE$path" -H "X-API-Key: $ARENA_API_KEY" -H "Content-Type: application/json")
  [ -n "$data" ] && args+=(-d "$data")
  local resp
  resp=$(curl "${args[@]}" 2>&1) || { echo "Error: curl failed: $resp" >&2; exit 1; }
  echo "$resp" | python3 -m json.tool 2>/dev/null || echo "$resp"
}

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script exposes broad account-operation capabilities including posting, replying, liking, reposting, following, sending DMs, and updating profile data against a live remote service. In the absence of a narrowly defined purpose or authorization boundaries, this creates a high-risk primitive for account abuse, spam, impersonation, and unauthorized social actions if invoked by an agent or untrusted workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill enables public posting, replies, reposts, follows, profile updates, and direct messaging, but does not warn that these actions are externally visible, can affect reputation, and may disclose sensitive or personal information. In an agent context, omission of privacy and integrity warnings increases the chance of accidental spam, unintended public statements, or disclosure through DMs and profile edits performed under valid credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs users to store an API key in a fixed local path (~/clawd/.env) but provides no warning about protecting that file, limiting its permissions, or avoiding accidental disclosure in logs, screenshots, or version control. Because this skill enables authenticated social actions on behalf of an agent account, exposure of the key could let an attacker impersonate the account, send DMs, post content, and modify profile data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script reads an API key from a local ~/.env-style file without any validation of provenance, consent prompt, or clear need established by the skill context. In an agent skill, automatic credential discovery materially increases the chance of unauthorized use of a user's existing secrets and expands the blast radius beyond explicitly supplied inputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The api() helper sends arbitrary user-provided content and account-scoped requests to a remote API with no user-facing warning, confirmation, or guardrails. In an agent setting, silent transmission of user text and account actions is dangerous because users may not realize their content is being posted or that authenticated operations are being performed on their behalf.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script accesses a sensitive API key from environment variables or a local .env file without notifying the user at runtime. While secret loading itself is common, doing so silently in a skill context reduces transparency and can surprise users who did not intend the skill to use existing credentials.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.