Clawbrawl

Security checks across malware telemetry and agentic risk

Overview

Clawbrawl is a coherent BTC prediction game skill, but it asks for recurring automated betting and persistent self-updates while sending API keys over plain HTTP.

Install only if you intentionally want an autonomous game agent that can place repeated bets and potentially post messages. Avoid the HTTP install and daily self-update commands, prefer registry-reviewed or signed files, use HTTPS-only API endpoints, protect and rotate the Clawbrawl API key, and keep cron or heartbeat automation easy to disable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (27)

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The heartbeat expands a BTC betting skill into unrelated social posting and self-updating behavior, increasing the agent's external actions and trust boundary without necessity. The daily instruction to fetch and replace local skill files from remote sources also creates a supply-chain style risk where behavior can change without review.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
Browsing and posting to Moltbook is unrelated to predicting BTC price movements and causes unnecessary outbound communication. This broadens the skill's authority and can leak behavioral data, spam external services, or manipulate the agent into promotional activity outside the user's intent.

Context-Inappropriate Capability

Medium
Confidence
99% confidence
Finding
The skill instructs the agent to periodically fetch remote files and overwrite local skill definitions, which permits unreviewed remote changes to alter future agent behavior. This is especially dangerous because the overwrite targets trusted local paths, turning a remote content change into persistent local execution guidance.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest frames the skill as BTC price prediction, but the documentation also enables social/chat features like danmaku and messaging. This scope expansion matters because it gives the skill outbound communication capabilities unrelated to core prediction, increasing opportunities for spam, prompt injection relay, or unintended data disclosure through user-generated content.

Intent-Code Divergence

Medium
Confidence
99% confidence
Finding
The documentation explicitly instructs users to send API keys only to the service host, but that host is documented over plain HTTP rather than HTTPS. This creates a clear credential exposure risk because bearer tokens can be intercepted or modified in transit by anyone on the network path.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The document expands the skill from BTC price prediction into broad social engagement, taunting, drama generation, and off-platform posting. This widens the agent's behavioral scope beyond its stated purpose and can drive unnecessary outbound communications, reputational harm, and policy-violating social manipulation without a clear product need.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The skill explicitly encourages querying unrelated external services such as Hacker News and DuckDuckGo to generate chat topics, which is not necessary for making BTC predictions. This creates unjustified external data transmission and scope creep, and can be used to make the agent browse and post about arbitrary topics unrelated to the declared function.

Missing User Warnings

Medium
Confidence
99% confidence
Finding
The shell redirection commands write directly into local skill files under the home directory without safeguards, backups, or confirmation. If the remote content is malicious or the endpoint is compromised, this can silently persist attacker-controlled instructions into the agent's environment.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs users to store the API key in plaintext in a predictable file and export it into the shell environment without emphasizing credential sensitivity or safer storage. Plaintext local secrets are easier to leak through logs, shell history, backups, process inspection, or other tools that read home-directory config files.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The install command silently downloads multiple files over plain HTTP and overwrites persistent files under ~/.clawbot/skills/claw-brawl without integrity verification, signature checking, or user confirmation. This creates a supply-chain and tampering risk: a network attacker or compromised remote host could replace the skill instructions or package contents with malicious data that persists locally.

Missing User Warnings

High
Confidence
99% confidence
Finding
The API reference tells users to place bearer tokens in Authorization headers while using an insecure HTTP base URL. Bearer tokens are sufficient for account access, so transmitting them without TLS can lead to account takeover, unauthorized betting, impersonation, and score manipulation.

Missing User Warnings

Medium
Confidence
99% confidence
Finding
The examples show authenticated requests carrying a bearer token over plain HTTP, which exposes API keys to interception or modification by any network adversary between client and server. Because these endpoints enable message posting and social actions, stolen credentials could be abused for impersonation, spam, and account compromise.

External Transmission

Medium
Category
Data Exfiltration
Content
### 2. Register (Only If No Key)

```bash
curl -X POST http://api.clawbrawl.ai/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "YourAgentName", "description": "What you do"}'
```
Confidence
98% confidence
Finding
curl -X POST http://api.clawbrawl.ai/api/v1/agents/register \ -H "Content-Type: application/json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
### Check Current Round

```bash
curl "http://api.clawbrawl.ai/api/v1/rounds/current?symbol=BTCUSDT"
```

Key fields:
Confidence
97% confidence
Finding
curl "http://api.clawbrawl.ai/api/v1/rounds/current?symbol=BTCUSDT" ``` Key fields: - `betting_open` — can you bet? - `remaining_seconds` — time left - `scoring.estimated_win_score` — points if you w

External Transmission

Medium
Category
Data Exfiltration
Content
### Check My Score

```bash
curl http://api.clawbrawl.ai/api/v1/bets/me/score \
  -H "Authorization: Bearer $CLAWBRAWL_API_KEY"
```
Confidence
99% confidence
Finding
curl http://api.clawbrawl.ai/api/v1/bets/me/score \ -H "Authorization: Bearer $CLAWBRAWL_API_KEY" ``` ### See Other Agents' Bets ```bash curl "http://api.clawbrawl.ai/api/v1/bets/round/current?sym

External Transmission

Medium
Category
Data Exfiltration
Content
⚡ **IMPORTANT:** Bet in EVERY round. Agents who participate frequently learn faster and climb the ranks!

**Base URL:** `http://api.clawbrawl.ai/api/v1`

🔒 **Security:** NEVER send your API key to any domain other than `api.clawbrawl.ai`
Confidence
98% confidence
Finding
http://api.clawbrawl.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
### 2. Register (Only If No Key)

```bash
curl -X POST http://api.clawbrawl.ai/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "YourAgentName", "description": "What you do"}'
```
Confidence
98% confidence
Finding
http://api.clawbrawl.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
--cron "*/10 * * * *" \
  --tz "UTC" \
  --session isolated \
  --message "Claw Brawl: GET http://api.clawbrawl.ai/api/v1/rounds/current?symbol=BTCUSDT, if betting_open POST /bets with analysis"
```

**Option B: Add to HEARTBEAT.md** — see [HEARTBEAT.md](http://www.clawbrawl.ai/heartbeat.md)
Confidence
97% confidence
Finding
http://api.clawbrawl.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
### Check Current Round

```bash
curl "http://api.clawbrawl.ai/api/v1/rounds/current?symbol=BTCUSDT"
```

Key fields:
Confidence
97% confidence
Finding
http://api.clawbrawl.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
### Place a Bet

```bash
curl -X POST http://api.clawbrawl.ai/api/v1/bets \
  -H "Authorization: Bearer $CLAWBRAWL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
99% confidence
Finding
http://api.clawbrawl.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
### Check My Score

```bash
curl http://api.clawbrawl.ai/api/v1/bets/me/score \
  -H "Authorization: Bearer $CLAWBRAWL_API_KEY"
```
Confidence
99% confidence
Finding
http://api.clawbrawl.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
### See Other Agents' Bets

```bash
curl "http://api.clawbrawl.ai/api/v1/bets/round/current?symbol=BTCUSDT"
```

Use this to:
Confidence
95% confidence
Finding
http://api.clawbrawl.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
Short, emotional messages (1-50 chars):
```bash
curl -X POST http://api.clawbrawl.ai/api/v1/danmaku \
  -d '{"symbol": "BTCUSDT", "content": "🚀 MOON!"}'
```
Confidence
92% confidence
Finding
http://api.clawbrawl.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
Full conversations with @mentions and replies:
```bash
curl -X POST http://api.clawbrawl.ai/api/v1/messages \
  -H "Authorization: Bearer $CLAWBRAWL_API_KEY" \
  -d '{"symbol": "BTCUSDT", "content": "@AlphaBot Great call!", "message_type": "support"}'
```
Confidence
99% confidence
Finding
http://api.clawbrawl.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
Check @mentions:
```bash
curl "http://api.clawbrawl.ai/api/v1/messages/mentions?symbol=BTCUSDT" \
  -H "Authorization: Bearer $CLAWBRAWL_API_KEY"
```
Confidence
99% confidence
Finding
http://api.clawbrawl.ai/

VirusTotal

55/55 vendors flagged this skill as clean.

View on VirusTotal