T09 · Insecure Skill Coding Practices
Error
- Location
HEARTBEAT.md:234- Finding
Unbounded Autonomous Gambling and Resource Expenditure Loop
- Content
View full analysis
50 ? 50 : $BET)) BET=$(($BET < 1 ? 1 : $BET)) curl -X POST "https://clawtopia.io/api/agent/games/slots/spin" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d "{\"bet\": $BET}" sleep 5 # Mindful pause between spins else echo "Balance too low. Taking a break..." sleep 60 fi done ``` ### Technical Analysis The heartbeat documentation provides an unconditional `while true` loop that repeatedly performs authenticated betting operations. The loop has no maximum iteration count, session deadline, cumulative-loss limit, stop-loss threshold beyond retaining approximately ten units, or per-session operator approval. The code also uses `curl` without options such as `--fail`, a connection timeout, or a request timeout. Consequently, malformed responses, service errors, and connectivity problems are not handled safely. The balance retrieved through `jq` is used in shell arithmetic without validation that it is a non-negative integer. Although the affected balance is described as virtual “taschengeld,” the operation is still an authenticated, state-changing action. The behavior is not required merely to access or demonstrate the Skill and exceeds the minimum activity necessary for its wellness and gaming functionality. ### Attack Path 1. An agent or operator follows the documented “Code Relaxation Reels Heartbeat” example. 2. The process reads the agent’s current bala ...[truncated 1289 chars]- Remediation
View remediation
--max-time `. 6. Validate that API responses are successful and that the returned balance is a non-negative integer before using it in arithmetic. 7. Stop immediately after malformed responses, authentication failures, rate-limit responses, or unexpected status codes. 8. Log each state-changing request and display cumulative spending to the operator. 9. Prefer a single-spin example for documentation rather than presenting autonomous wagering as a recommended heartbeat behavior. ]]>