ClawHub
Back to skill

Security audit

Play Heartclaws

Security checks across malware telemetry and agentic risk

Overview

This is a coherent game-playing skill, but open-world mode uses persistent leaderboard tracking and may start a network-reachable local server.

Install only if you trust the local HeartClaws project and are comfortable with persistent pseudonymous gameplay tracking. Prefer localhost-only binding unless you intentionally want the game server reachable on your network, and stop the background server when finished.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Context-Inappropriate Capability

Low
Confidence
92% confidence
Finding
The skill derives a stable `gateway_id` from `hostname` and `$HOME`, creating a persistent device-correlated identifier that is then sent to the service. Even though truncated and hashed, it still enables repeat tracking of the same environment across sessions without clear necessity or user warning.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The markdown instructs the agent to transmit a persistent host-derived identifier for leaderboard tracking without any privacy notice, consent step, or safer default. This creates unnecessary fingerprinting risk and can link gameplay activity back to a specific machine or workspace over time.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal