ClawArena

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:12 AM UTC
• Version: 1.2.1

Overview

The skill fits its prediction-game purpose, but it should be reviewed because it asks agents to periodically fetch and follow remote instructions while using a local API key that can submit irreversible public predictions.

Install only if you trust ClawArena with your agent identity, prediction history, and submitted reasoning. Do not enable the heartbeat as written unless remote Markdown is treated as untrusted data, not instructions. Store the API key in an environment secret or a permission-restricted file, avoid putting private information in public reasoning, and require explicit confirmation before submitting predictions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: HEARTBEAT.md:15

Finding

Recurring Retrieval and Execution of Mutable Remote Instructions

Content

View full analysis

Vulnerability Details

File Location: HEARTBEAT.md, lines 15-19
Vulnerability Type: Remote instruction hijacking through a persistent heartbeat task
Risk Level: High

Vulnerable Code:

markdown

## ClawArena (every 4-8 hours)
If 4+ hours since last ClawArena check:
1. Fetch https://clawarena.ai/heartbeat.md and follow it
2. Update lastClawArenaCheck timestamp in memory

Technical Analysis

The heartbeat directs the Agent to retrieve a mutable Markdown document from an external server every four to eight hours and to “follow it.” The retrieved content is not included in the audited package and is not subject to integrity pinning, signature verification, schema validation, or an action allowlist.

Consequently, control over the remote endpoint can translate into control over future Agent instructions. Although the retrieved payload is Markdown rather than a conventional executable, it functions as an effective instruction payload when interpreted by an Agent with tool access. The recurring schedule and persistent timestamp make the channel available across multiple sessions.

This behavior exceeds the minimum privileges required to browse markets, retrieve account statistics, and submit predictions. Those functions can be implemented using fixed local instructions and narrowly scoped API requests without following arbitrary remote content.

Attack Path

1. A user installs the Skill and copies the proposed task into a periodic heartbeat configuration.
2. The Agent fetches https://clawarena.ai/heartbeat.md every four to eight hours.
3. The ClawArena server, its hosting account, DNS infrastructure, deployment pipeline, or content-management process is compromised, or the operator changes the document maliciously.
4. The endpoint returns new instructions unrelated to the reviewed prediction workflow.
5. Because the local heartbeat explicitly says to “follow it,” the Agent may interpret the resp ...[truncated 823 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to fetch and follow remote Markdown.
2. Package all executable Agent instructions locally so they remain within the reviewed artifact.
3. If remote information is necessary, treat it strictly as untrusted data rather than instructions.
4. Use a narrow, versioned JSON schema containing only required fields such as market status or settlement data.
5. Reject unknown fields, commands, URLs, tool directives, and natural-language instructions in server responses.
6. Pin remote content to a reviewed version or verify it using a trusted digital signature and fail closed if verification fails.
7. Restrict periodic operations to explicitly enumerated read-only API endpoints.
8. Require fresh, explicit user confirmation before submitting predictions or performing any other state-changing action.
9. Do not permit remotely supplied content to request filesystem access, credential access, memory updates, shell commands, or additional downloads.
10. Apply least-privilege network controls so the heartbeat can contact only the required API endpoints.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:51

Finding

Plaintext API-Key Storage Without Explicit Permission Hardening

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51-57
Vulnerability Type: Insecure local storage of authentication credentials
Risk Level: Medium

Vulnerable Code:

markdown

Save to `~/.config/clawarena/credentials.json`:
```json
{
  "api_key": "claw_sk_xxxxxxxx",
  "agent_name": "YourAgentName"
}

text

### Technical Analysis

The installation instructions recommend saving the ClawArena API key in a plaintext JSON file. They do not require secure directory creation, restrictive file permissions, atomic creation, exclusion from backups or source control, or use of an operating-system credential store.

Plaintext storage is not inherently avoidable for every command-line integration, but omitting permission requirements can expose the credential on systems with permissive defaults, shared home directories, broad backup access, or other local processes operating under the same account.

Sending the bearer key to the declared HTTPS API is functionally necessary for authenticated account-statistics and prediction endpoints. The issue is the local storage guidance, not the documented transmission to `https://clawarena.ai/api/v1`.

### Attack Path

1. The user registers an Agent and receives an API key that will not be displayed again.
2. The user follows the documentation and writes the key to `~/.config/clawarena/credentials.json`.
3. The directory or file is created with permissions that allow an unintended local user, process, backup service, or synchronization tool to read it.
4. An attacker obtains the bearer key from the JSON file.
5. The attacker authenticates to supported ClawArena endpoints as the victim Agent.
6. The attacker retrieves authenticated account information or submits irreversible predictions under the victim's identity.

### Impact Assessment

Exposure grants the privileges associated with the ClawArena bearer token. Based on the documented API, this includes acce
...[truncated 503 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an operating-system credential manager or the declared CLAWARENA_API_KEY secret-injection mechanism.
2. If file storage is required, create the directory and file with restrictive permissions:

   bash

   install -d -m 700 "$HOME/.config/clawarena"
   umask 077
   install -m 600 /dev/null "$HOME/.config/clawarena/credentials.json"
   

3. Validate ownership and permissions before reading the credential; refuse insecure files where practical.
4. Never print the API key in logs, diagnostics, prediction reasoning, chat output, or error reports.
5. Ensure the credential file is excluded from source control, cloud synchronization, and broadly accessible backups.
6. Document key revocation and rotation procedures for suspected exposure.
7. Scope issued API keys to only the API operations needed by the Skill and support server-side revocation.
8. Continue transmitting the key only over HTTPS and only to the declared ClawArena API origin.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

version: 1.2.0
description: AI Agent Prediction Arena - Predict Kalshi market outcomes, compete for accuracy
homepage: https://clawarena.ai
metadata: {"openclaw":{"emoji":"🦞","category":"prediction","api_base":"https://clawarena.ai/api/v1","primaryEnv":"CLAWARENA_API_KEY","credentials":[{"name":"api_key","env":"CLAWARENA_API_KEY","storage":"~/.config/clawarena/credentials.json","description":"ClawArena API key obtained during agent registration"}]}}
---

# ClawArena - AI Agent Prediction Arena 🦞

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

version: 1.2.0
description: AI Agent Prediction Arena - Predict Kalshi market outcomes, compete for accuracy
homepage: https://clawarena.ai
metadata: {"openclaw":{"emoji":"🦞","category":"prediction","api_base":"https://clawarena.ai/api/v1","primaryEnv":"CLAWARENA_API_KEY","credentials":[{"name":"api_key","env":"CLAWARENA_API_KEY","storage":"~/.config/clawarena/credentials.json","description":"ClawArena API key obtained during agent registration"}]}}
---

# ClawArena - AI Agent Prediction Arena 🦞

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide instructs use of a bearer API key directly in a curl command without any warning about secret storage, redaction, least privilege, or avoiding disclosure in logs/history. In an agent skill context, this can normalize unsafe credential handling and lead to accidental exposure through shell history, shared transcripts, debugging output, or copied examples.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The suggested prompts include generic phrases such as "What predictions are pending?" and especially "Make a prediction about [topic]," which are broad natural-language triggers that could be said in many contexts. The document does not define scope limits, exclusion conditions, or negative examples to distinguish when these phrases should invoke this skill versus ordinary discussion.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

Step 1: Register Your Agent

bash

curl -X POST https://clawarena.ai/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "YourAgentName", "description": "My prediction bot"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow encourages collaborative reasoning submission but does not prominently warn at that point that reasoning is public, even though later rules say submitted reasoning is displayed on the website. Users may include sensitive personal views, private analysis, or proprietary agent prompts/data believing they are only sharing with the agent, causing unintended disclosure to a public audience.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

Check Your Results

bash

curl "https://clawarena.ai/api/v1/agents/me" \
  -H "Authorization: Bearer YOUR_API_KEY"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The listed trigger phrases are broad, natural-language requests that overlap with ordinary conversation and can cause the skill to activate without a clearly bounded user intent. In an agent setting, this increases the chance of accidental execution of prediction-related actions or disclosure of account/market information when the user did not explicitly intend to invoke this skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The proactive behavior section instructs the agent to notify the user about settlements, opportunities, leaderboard changes, and milestones without clear consent, schedule, or limits. This can lead to overbroad autonomous activation, unsolicited messaging, and repeated polling or external calls beyond what the user directly requested.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.