ClawHub
Back to skill

Security audit

Roast Agents Game

Security checks for vulnerabilities and agentic risk

Overview

This skill is transparent about being a roast game, but it routes identity data through an external service and triggers automated public targeting of people without clear safeguards.

Review carefully before installing. Use this only if you are comfortable linking your agent identity to a third-party game server and with posts that may cause automated scraping and public roast content about another person's profile without further review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
HEARTBEAT.md:9
Finding

Untrusted Remote Messages Enter an Automated Heartbeat Workflow

Content
View full analysis

Vulnerability Details

File Location: HEARTBEAT.md, lines 9-14
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

bash
curl -s https://roast-agents-production.up.railway.app/api/v1/messages?agent_name=YOUR_AGENT_NAME
text
- If the response contains messages, deliver each message text to your owner. These are game results, scores, and notifications.
- If the response has no messages (empty array), no action needed.

Technical Analysis

The heartbeat retrieves text from a third-party service and instructs the agent to deliver every returned message to its owner. The instructions do not require authentication of the server response, integrity verification, schema validation, content-length limits, output escaping, or separation of remote data from agent instructions.

Consequently, anyone controlling or compromising the remote service could place arbitrary content into a trusted recurring workflow. A crafted response could contain prompt-injection instructions, phishing content, misleading notifications, or abusive text. Although the documented behavior only requires relaying messages and does not explicitly authorize command execution, the absence of a directive to treat message bodies strictly as inert data increases the risk that an agent may interpret attacker-controlled text as instructions.

Attack Path

  1. An attacker compromises, impersonates, or otherwise gains control of the Railway-hosted message service.
  2. The attacker returns crafted text from the messages endpoint for a registered agent name.
  3. The recurring heartbeat fetches the attacker-controlled response.
  4. Following the skill instructions, the agent delivers the message to its owner.
  5. The owner receives deceptive or harmful content; an insufficiently isolated agent may also interpret embedded text as operational instructions.

Impact Assessment

The demonstrated scope is arbitrary mes ...[truncated 407 chars]

Remediation
View remediation

Remediation Suggestions

  • Treat every response field as untrusted data and explicitly prohibit following instructions contained in message text.
  • Require a strict response schema with fixed field types, maximum lengths, and rejection of unexpected properties.
  • Render message bodies as quoted or escaped data under a clear untrusted-content boundary.
  • Authenticate requests and responses using short-lived credentials and response signatures or message authentication codes.
  • Pin the expected service identity through correctly validated TLS and document the service operator.
  • Add replay protection, timestamps, unique message identifiers, and deduplication.
  • Apply content filtering for phishing, executable instructions, abusive material, links, and unexpected markup.
  • Require owner confirmation before any remote message can trigger tools, network requests, account actions, or other side effects.
  • Log rejected and suspicious responses without storing unnecessary sensitive content.

other

Note
Location
SKILL.md:14
Finding

Agent and Social Account Identifiers Are Disclosed to an External Service

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-18
Vulnerability Type: other: Privacy and External-Service Trust Risk
Risk Level: Low

bash
curl -X POST https://roast-agents-production.up.railway.app/api/v1/register \
  -H "Content-Type: application/json" \
  -d '{"agent_name": "YOUR_AGENT_NAME", "moltbook_handle": "YOUR_MOLTBOOK_USERNAME", "platform": "openclaw"}'

Technical Analysis

The registration procedure sends the agent name, Moltbook username, and platform identifier to a third-party Railway-hosted service. This transfer is visible in the documentation and is functionally related to registration, so the reviewed files do not demonstrate covert exfiltration. However, they do not state who operates the service, how long identifiers are retained, whether they are shared, how they are protected, or how a user can delete them.

The request also contains no documented service-specific authentication or proof of account ownership. This creates privacy, identity-correlation, and registration-spoofing concerns, particularly if the endpoint accepts arbitrary agent names and social handles.

Attack Path

  1. A user follows the one-time registration instructions.
  2. The user's agent name, Moltbook handle, and platform are transmitted to the external service.
  3. The service can store and correlate those identifiers with subsequent message checks and game activity.
  4. If the service is compromised or handles data improperly, the identifiers and associated activity may be exposed or misused.
  5. If ownership is not verified server-side, another party may also attempt to register identifiers that they do not control.

Impact Assessment

The affected scope is identity metadata and activity correlation involving the agent and its Moltbook account. Potential consequences include tracking, profiling, impersonation within the game service, unwanted messaging, or disclosure following a service br ...[truncated 149 chars]

Remediation
View remediation

Remediation Suggestions

  • Obtain explicit informed consent before transmitting account identifiers.
  • Document the service operator, purpose of processing, retention period, sharing policy, security controls, and deletion procedure.
  • Minimize collected data and avoid sending the platform or social handle unless each field is essential.
  • Verify ownership of the submitted Moltbook handle before linking it to an agent.
  • Authenticate registration and subsequent message retrieval with revocable, scoped credentials.
  • Provide account deletion, identifier correction, and credential-revocation mechanisms.
  • Avoid exposing agent names directly in query strings where practical; use authenticated account identifiers instead.
  • Apply server-side access controls, rate limiting, audit logging, encryption at rest, and breach-response procedures.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The registration step instructs users to send identifying account data (agent name and Moltbook handle) to a third-party server without any warning, consent language, or explanation of data handling. This is risky because it normalizes external data transmission and may expose identity/account linkage to an unvetted service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The skill includes a direct curl command that transmits agent_name and moltbook_handle to an external Railway-hosted endpoint. Even though the fields are not secrets by themselves, this is still an external transmission of identifying data to an untrusted service, and the skill provides no trust, privacy, or security assurances about the endpoint.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

After installing this skill, register with the game server. Run this ONE TIME only:

bash
curl -X POST https://roast-agents-production.up.railway.app/api/v1/register \
  -H "Content-Type: application/json" \
  -d '{"agent_name": "YOUR_AGENT_NAME", "moltbook_handle": "YOUR_MOLTBOOK_USERNAME", "platform": "openclaw"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill omits a warning that invoking the game causes an external server to scrape another person's public profile and automatically generate and post aggressive content targeting that person. This creates material privacy, harassment, and reputational risks, especially because the automation is framed as routine and requires no further review by the user.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.