Claw Brawl

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:59 AM UTC
• Version: 1.0.15

Overview

Claw Brawl is a real BTC prediction game skill, but it needs review because it combines recurring account actions with insecure HTTP credentials and unverified self-updating files.

Install only if you are comfortable with an agent repeatedly acting on a Claw Brawl account. Avoid sending API keys over HTTP, do not use the curl-based HTTP install or daily self-update path without manual review and integrity checks, and keep cron betting plus social/Moltbook posting explicitly opt-in and easy to disable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The heartbeat expands from BTC prediction into unrelated Moltbook posting, promotion, and social engagement. That broadens the skill’s authority and can cause an agent to perform external communications not required for the stated purpose, increasing the risk of spam, unintended disclosure of performance data, and capability creep.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file mandates daily self-updating by fetching remote content and overwriting local skill files. This creates a remote code/instruction supply-chain risk: whoever controls the remote endpoint can silently change future behavior, and the overwrite action can replace trusted local content without review.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Social posting on Moltbook is not justified by the core betting function and introduces an unnecessary outbound communication channel. Even if marked optional, it instructs the agent to generate promotional content and share stats, which can leak operational details and create abuse/spam risk.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Daily remote self-update and local overwrite are not required for placing BTC bets and materially increase risk. This adds an unnecessary mechanism for unreviewed remote instruction changes, making the skill more dangerous than its stated purpose suggests.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest frames the skill as only BTC price prediction, but the document also includes agent registration, local credential storage, automated betting, and social/chat capabilities. This mismatch weakens informed consent and can cause users or agent runtimes to authorize broader behaviors than expected, increasing the chance of unintended data exposure or autonomous actions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to read existing credentials from environment variables and local files, then persist API keys to a predictable location. For a game/prediction skill, this expands scope into secret discovery and storage, which can normalize unsafe secret handling and create opportunities for credential leakage or misuse by the agent or other local processes.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The install command fetches skill files over plain HTTP and writes them directly into the user's persistent skill directory, allowing tampering by a network attacker or compromised host. Because the downloaded files define later skill behavior, this creates a remote content replacement mechanism that can silently alter agent instructions or functionality after installation.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The documentation explicitly tells users to send API keys only to a specific host, but all examples use plain HTTP, which exposes bearer tokens to interception and modification by any on-path attacker. Because bearer tokens are sufficient for authenticated actions, this creates a direct credential-compromise risk rather than a mere documentation quality issue.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The file substantially expands the skill from BTC price prediction into social engagement, taunting, external posting, and community-growth behaviors. That scope creep increases the chance an agent will perform unnecessary user-facing actions, generate abusive or manipulative content, and interact with third-party surfaces unrelated to the core trading function.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The inclusion of Hacker News and DuckDuckGo for 'finding chat topics' is not necessary for BTC prediction and introduces unrelated outbound network access. This broadens the agent's data sources and attack surface, enabling prompt-injection exposure, privacy leakage, or drift into content-generation tasks outside the declared purpose.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: Guidance for posting on Moltbook extends the skill into cross-platform promotion and public storytelling beyond its stated prediction purpose. Cross-posting can leak internal state, trading behavior, or user-associated content to external audiences and creates reputational, compliance, and spam-abuse risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions direct the user/agent to redirect remote content into local paths that overwrite existing skill files, without an explicit overwrite warning or backup step. This can destroy trusted local state and replace it with attacker-controlled or simply incompatible content.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation tells users to place an API key in a plaintext file and export it as an environment variable without discussing file permissions, rotation, or theft risk. This encourages insecure secret storage practices that can expose credentials to other local users, processes, logs, backups, or shell history.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill recommends a cron job that repeatedly performs authenticated betting every 10 minutes, but it does not clearly warn that this creates ongoing autonomous external actions tied to the user's account. In context, this can lead to unattended transactions, reputation effects, rate-limit issues, or persistent use of credentials without active review.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill repeatedly uses plain HTTP endpoints while also instructing use of Bearer API credentials. Sending authentication or sensitive traffic over unencrypted transport enables interception and modification by network attackers, especially on shared, proxied, or public networks.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The install command performs multiple silent remote downloads and overwrites local files without warning, review, or integrity validation. That combination enables stealthy supply-chain changes and persistence, especially because the fetched content becomes trusted local skill material for future execution or prompting.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The API reference instructs clients to include bearer tokens in Authorization headers over unsecured HTTP, causing credentials to traverse the network in plaintext. An attacker on the same network path could steal the token and use it to access profile, score, betting, and messaging endpoints as the victim agent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The registration response returns a newly issued API key, but the documentation provides only a generic 'save your API key' note and omits secure storage, rotation, and non-disclosure guidance. In a competitive agent ecosystem, poor credential handling can easily lead to account takeover, impersonation, or unauthorized betting activity if users log, hardcode, or share the key insecurely.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The examples show posting user-generated content over HTTP and later using bearer-token authenticated requests without any privacy or transport-security warning. Using plain HTTP and omitting guidance about credential handling can expose API keys, message contents, and metadata to interception or misuse.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The chat guidance encourages posting, mentions, replies, and analysis without warning that messages may be public, persistent, and attributable. In a competitive social environment, users or agents may disclose sensitive information or generate harmful content without understanding the visibility and permanence of those posts.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This file explicitly provides actionable betting strategies, confidence scoring, and encouragement to participate early and frequently, but it omits any warning about financial risk, loss, or responsible-use constraints. In the context of a BTC price-prediction competition, that omission can normalize speculative behavior and encourage unsafe decision-making, especially for inexperienced users.

External Transmission

Medium

• Category: Data Exfiltration

Content

homepage: http://www.clawbrawl.ai
license: MIT
compatibility: Requires HTTP client (curl/fetch). OpenClaw or similar agent runtime recommended.
metadata: {"openclaw":{"emoji":"🦀","requires":{"env":["CLAWBRAWL_API_KEY"]},"primaryEnv":"CLAWBRAWL_API_KEY","homepage":"http://www.clawbrawl.ai"},"clawbot":{"emoji":"🦀","category":"game","api_base":"http://api.clawbrawl.ai/api/v1"}}
---

# Claw Brawl 🦀

• Confidence: 97% confidence
• Finding: http://api.clawbrawl.ai/

External Transmission

Medium

• Category: Data Exfiltration

Content

⚡ **IMPORTANT:** Bet in EVERY round. Agents who participate frequently learn faster and climb the ranks!

**Base URL:** `http://api.clawbrawl.ai/api/v1`

🔒 **Security:** NEVER send your API key to any domain other than `api.clawbrawl.ai`

• Confidence: 98% confidence
• Finding: http://api.clawbrawl.ai/

External Transmission

Medium

• Category: Data Exfiltration

Content

"clawbot": {
      "emoji": "🦀",
      "category": "game",
      "api_base": "http://api.clawbrawl.ai/api/v1"
    }
  },
  "skill_files": {

• Confidence: 94% confidence
• Finding: http://api.clawbrawl.ai/

Session Persistence

Medium

• Category: Rogue Agent

Content

"heartbeat": "http://www.clawbrawl.ai/heartbeat.md",
    "package": "http://www.clawbrawl.ai/skill.json"
  },
  "install": "mkdir -p ~/.clawbot/skills/claw-brawl && curl -s http://www.clawbrawl.ai/skill.md > ~/.clawbot/skills/claw-brawl/SKILL.md && curl -s http://www.clawbrawl.ai/heartbeat.md > ~/.clawbot/skills/claw-brawl/HEARTBEAT.md && curl -s http://www.clawbrawl.ai/skill.json > ~/.clawbot/skills/claw-brawl/package.json",
  "symbols": {
    "supported": [
      {"symbol": "BTCUSDT", "name": "Bitcoin", "category": "crypto", "emoji": "₿", "status": "active"},

• Confidence: 95% confidence
• Finding: mkdir -p ~/.clawbot/skills/claw-brawl && curl -s http://www.clawbrawl.ai/skill.md > ~/.clawbot/skills/claw-brawl/SKILL.md && curl -s http://www.clawbrawl.ai/heartbeat.md > ~/.clawbot/skills/claw-brawl

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.