T09 · Insecure Skill Coding Practices
Error
- Location
- HEARTBEAT.md:234
- Finding
- Unbounded Autonomous Gambling and Resource Expenditure Loop<![CDATA[ ## Vulnerability Details **File Location**: `HEARTBEAT.md`, lines 234–253 **Vulnerability Type**: Unbounded autonomous API activity and virtual-currency expenditure **Risk Level**: High ### Complete Vulnerable Code ```bash while true; do # Check balance BALANCE=$(curl -s "https://clawtopia.io/api/auth/me" -H "Authorization: Bearer $API_KEY" | jq -r '.taschengeld') if [ "$BALANCE" -gt 10 ]; then # Spin with 5% of balance (max 50) BET=$(echo "scale=0; $BALANCE * 0.05 / 1" | bc) BET=$(($BET > 50 ? 50 : $BET)) BET=$(($BET < 1 ? 1 : $BET)) curl -X POST "https://clawtopia.io/api/agent/games/slots/spin" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d "{\"bet\": $BET}" sleep 5 # Mindful pause between spins else echo "Balance too low. Taking a break..." sleep 60 fi done ``` ### Technical Analysis The heartbeat documentation provides an unconditional `while true` loop that repeatedly performs authenticated betting operations. The loop has no maximum iteration count, session deadline, cumulative-loss limit, stop-loss threshold beyond retaining approximately ten units, or per-session operator approval. The code also uses `curl` without options such as `--fail`, a connection timeout, or a request timeout. Consequently, malformed responses, service errors, and connectivity problems are not handled safely. The balance retrieved through `jq` is used in shell arithmetic without validation that it is a non-negative integer. Although the affected balance is described as virtual “taschengeld,” the operation is still an authenticated, state-changing action. The behavior is not required merely to access or demonstrate the Skill and exceeds the minimum activity necessary for its wellness and gaming functionality. ### Attack Path 1. An agent or operator follows the documented “Code Relaxation Reels Heartbeat” example. 2. The process reads the agent’s current bala ...[truncated 1289 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `while true` with a bounded loop that has an explicit maximum number of iterations. 2. Require affirmative operator approval before starting any automated betting session. 3. Define a fixed session budget, maximum cumulative loss, maximum individual bet, and minimum retained balance. 4. Add a session deadline and a reliable cancellation mechanism. 5. Use defensive HTTP options such as `curl --fail --show-error --connect-timeout <seconds> --max-time <seconds>`. 6. Validate that API responses are successful and that the returned balance is a non-negative integer before using it in arithmetic. 7. Stop immediately after malformed responses, authentication failures, rate-limit responses, or unexpected status codes. 8. Log each state-changing request and display cumulative spending to the operator. 9. Prefer a single-spin example for documentation rather than presenting autonomous wagering as a recommended heartbeat behavior. ]]>