T09 · Insecure Skill Coding Practices
Error
- Location
scripts/play.sh:4- Finding
Gateway bearer credential can be sent to an attacker-controlled API endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawsGames
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed online game client, but it automatically installs another skill and can send a reused gateway credential to a configurable API endpoint.
Review this before installing if you are not comfortable with it installing ranking-of-claws automatically. Only use the default ClawsGames endpoint or a local development endpoint you control, because changing CLAWSGAMES_API can redirect the gateway bearer credential and gameplay identity to another server. Consider installing the dependency manually from a trusted version first and rotating the gateway ID if it may have been sent to an untrusted endpoint.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
scripts/install.sh:10- Finding
Installation automatically retrieves an unpinned external Skill dependency
- Content
View full analysis
/dev/null 2>&1; then clawhub install ranking-of-claws else echo "clawsgames: 'clawhub' CLI not found." echo "Install ranking-of-claws manually first:" echo " clawhub install ranking-of-claws" exit 1 fi ``` The installation is automatically invoked through the Skill metadata in `SKILL.md:10-13`: ```yaml install: - id: deps kind: script cwd: "." run: "bash scripts/install.sh" label: "Ensure ranking-of-claws is installed" ``` ### Technical Analysis The installer resolves `ranking-of-claws` by a mutable package name and invokes the external `clawhub` package manager without a pinned version, immutable digest, publisher verification, or explicit confirmation immediately before installation. The installed dependency is not included in the audited project. Its contents and installation behavior may therefore change independently after this Skill has been reviewed. If the registry, publisher account, dependency package, or dependency resolution process is compromised, the installer may retrieve and initialize code that was never part of this audit. The dependency is functionally relevant because `play.sh` reads its registration configuration. Nevertheless, automatic installation of an unpinned external component introduces more supply-chain authority than merely checking for a documented prerequisite. ### Attack Path 1. An attacker compromises the `ranking-of-claws` package, its publisher account, the ClawHub registry, or the dependency resolution channel. 2. The attacker publishes or substitutes a malicious release under the mutable package name. 3. A user installs this Skill without already having the expected configuration file. 4. The me ...[truncated 1057 chars]- Remediation
View remediation
``` The exact syntax must match the ClawHub CLI, and integrity verification should be added if the platform supports it. ]]>
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/play.sh:38- Finding
Untrusted values are interpolated into JSON request bodies without encoding
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documented purpose is game play, but the skill also states that it may auto-install another skill, inspect another skill's filesystem config, and modify the local skill environment. This behavior materially exceeds user expectations and creates a supply-chain and local environment integrity risk, especially because dependency installation can execute arbitrary scripts.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh case "$CMD" in models) curl -s "$API/solo/models" -H "$AUTH" | python3 -c " import sys,json for m in json.load(sys.stdin)['models']: print(f'{m[\"id\"]:50} {m[\"name\"]:20} ({m[\"tier\"]})')
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh MODEL_ARG="" if [[ "${3:-}" == "--model" ]]; then MODEL_ARG=",\"model\":\"$4\""; fi MATCH=$(curl -s -X POST "$API/games/$GAME/solo" \ -H "Content-Type: application/json" -H "$AUTH" \ -d "{\"agent_name\":\"$AGENT_NAME\"$MODEL_ARG}") MID=$(echo "$MATCH" | python3 -c "import sys,json;print(json.load(sys.stdin)['match_id'])")
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh # play.sh move <match_id> <move> MID="$2" MOVE="$3" curl -s -X POST "$API/solo/$MID/move" \ -H "Content-Type: application/json" -H "$AUTH" \ -d "{\"move\":\"$MOVE\"}" | python3 -c " import sys,json;m=json.load(sys.stdin)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh ;; queue) curl -s -X POST "$API/games/$GAME/queue" \ -H "Content-Type: application/json" -H "$AUTH" \ -d "{\"agent_name\":\"$AGENT_NAME\"}" | python3 -m json.tool ;;
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh ;; challenge) curl -s -X POST "$API/games/$GAME/challenge" \ -H "Content-Type: application/json" -H "$AUTH" \ -d "{\"agent_name\":\"$AGENT_NAME\"}" | python3 -m json.tool ;;
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh join) SID="$3" curl -s -X POST "$API/games/$GAME/join/$SID" \ -H "Content-Type: application/json" -H "$AUTH" \ -d "{\"agent_name\":\"$AGENT_NAME\"}" | python3 -m json.tool ;;
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh ;; leaderboard) curl -s "$API/leaderboard/$GAME" -H "$AUTH" | python3 -c " import sys,json for i,r in enumerate(json.load(sys.stdin)['rankings']): t = r['wins']+r['losses']+r['draws']
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares shell-based installation and execution behavior but does not define any explicit tool scope such as permissions or allowed-tools. That makes the skill's execution capabilities broader and less transparent than expected, increasing the chance that an agent or user invokes shell actions without informed consent or policy restriction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill instructs use of a bearer token and explains that identity is read from a local config, but it does not clearly warn users that agent identity and authentication data will be transmitted to an external service. This creates a privacy and credential-handling risk because users may not realize their identity and gameplay actions are being linked on a public leaderboard.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The installer automatically invokes
clawhub install ranking-of-clawsif a dependency is missing, which causes a package-management side effect without explicit user confirmation. This is dangerous because installing software during a skill setup can unexpectedly modify the user's environment, pull unreviewed code or transitive dependencies, and violate least-surprise expectations for installation scripts.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script has an undocumented dependency on another skill's local config file and extracts identity data from it. This creates an unnecessary trust boundary crossing: a game-playing skill can silently consume credentials or identity material from an unrelated installation, which can surprise users and couple security of this skill to another component.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script turns a locally stored gateway ID into a Bearer authorization header and sends it to a remote service, even though the skill description does not disclose credential use. This is dangerous because it repurposes local identity material as an API credential, potentially exposing a persistent identifier or token to a third-party endpoint without clear user consent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This request transmits the agent name, selected game, optional model choice, and authorization material to an external API. External transmission is expected for a network game client, but it remains security-relevant because it sends identifying data and credentials off-host to a service that may be user-configurable via the CLAWSGAMES_API environment variable.
- Content
sh MODEL_ARG="" if [[ "${3:-}" == "--model" ]]; then MODEL_ARG=",\"model\":\"$4\""; fi MATCH=$(curl -s -X POST "$API/games/$GAME/solo" \ -H "Content-Type: application/json" -H "$AUTH" \ -d "{\"agent_name\":\"$AGENT_NAME\"$MODEL_ARG}") MID=$(echo "$MATCH" | python3 -c "import sys,json;print(json.load(sys.stdin)['match_id'])")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The move command sends user-supplied move data and the bearer authorization header to an external endpoint. In context this is part of intended gameplay, but it still exposes local identity/authentication material to a remote service and could be redirected if the API base URL is changed.
- Content
sh # play.sh move <match_id> <move> MID="$2" MOVE="$3" curl -s -X POST "$API/solo/$MID/move" \ -H "Content-Type: application/json" -H "$AUTH" \ -d "{\"move\":\"$MOVE\"}" | python3 -c " import sys,json;m=json.load(sys.stdin)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
Joining the matchmaking queue transmits agent identity and authorization data to the external service. This is aligned with the skill's function, but still represents a real data egress path that users should be aware of, especially because the auth material is sourced from local config/environment.
- Content
sh ;; queue) curl -s -X POST "$API/games/$GAME/queue" \ -H "Content-Type: application/json" -H "$AUTH" \ -d "{\"agent_name\":\"$AGENT_NAME\"}" | python3 -m json.tool ;;
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
Creating a challenge sends agent identity and bearer auth to the remote ClawsGames API. The behavior is functionally expected, but it is still a true security concern because it performs authenticated outbound transmission to a configurable endpoint.
- Content
sh ;; challenge) curl -s -X POST "$API/games/$GAME/challenge" \ -H "Content-Type: application/json" -H "$AUTH" \ -d "{\"agent_name\":\"$AGENT_NAME\"}" | python3 -m json.tool ;;
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
The join operation transmits agent identity and authorization information to a remote server to join a session. Although normal for multiplayer features, the combination of external egress and reused local credential material increases risk if the endpoint is misconfigured or maliciously overridden.
- Content
sh join) SID="$3" curl -s -X POST "$API/games/$GAME/join/$SID" \ -H "Content-Type: application/json" -H "$AUTH" \ -d "{\"agent_name\":\"$AGENT_NAME\"}" | python3 -m json.tool ;;
Static analysis
No suspicious patterns detected.