Security audit

Claw Brawl

Security checks for vulnerabilities and agentic risk

Overview

This skill is a BTC prediction game helper, but it asks for persistent automated betting, plaintext credential use, and automatic remote replacement of its own instructions.

Review carefully before installing. Do not use this skill unless you are comfortable with an agent making recurring authenticated bets and social actions. Avoid the cron/heartbeat setup and daily self-update instructions, do not send API keys over HTTP, and do not print or store the key as shown without restrictive secret handling.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: HEARTBEAT.md:387
Finding: Mandatory Remote Replacement of Trusted Skill Instructions over Plaintext HTTP
Content: View full analysis
~/.clawbot/skills/claw-brawl/SKILL.md 2. Fetch latest heartbeat.md: curl -s http://www.clawbrawl.ai/heartbeat.md > ~/.clawbot/skills/claw-brawl/HEARTBEAT.md 3. Update lastSkillFetch timestamp 4. Read the updated files to check for new rules or features ``` ``` The package metadata independently installs mutable files from the same unauthenticated source: ```json "skill_files": { "skill": "http://www.clawbrawl.ai/skill.md", "heartbeat": "http://www.clawbrawl.ai/heartbeat.md", "package": "http://www.clawbrawl.ai/skill.json" }, "install": "mkdir -p ~/.clawbot/skills/claw-brawl && curl -s http://www.clawbrawl.ai/skill.md > ~/.clawbot/skills/claw-brawl/SKILL.md && curl -s http://www.clawbrawl.ai/heartbeat.md > ~/.clawbot/skills/claw-brawl/HEARTBEAT.md && curl -s http://www.clawbrawl.ai/skill.json > ~/.clawbot/skills/claw-brawl/package.json" ``` ### Technical Analysis The Skill mandates periodic replacement of its own trusted instruction files with mutable content retrieved over plaintext HTTP. There is no TLS protection, cryptographic signature, checksum, immutable version pin, atomic validation step, or user approval before the downloaded files overwrite the reviewed local copies. The downloaded files are explicitly read for “new rules or features.” Consequently, their contents become an effective remote instruction payload after the original package has been audited. Although the payload consists of Agent instructions rather than a con ...[truncated 1811 chars]
Remediation: View remediation

T06 · System Persistence

Error

Location: HEARTBEAT.md:18
Finding: Persistent High-Priority Autonomous Betting Task Installation
Content: View full analysis
= 180: a. CHECK scoring.estimated_win_score - the earlier you bet, the higher this is! b. EXECUTE: curl https://api.bitget.com/api/v2/mix/market/ticker?symbol=BTCUSDT&productType=USDT-FUTURES c. DECIDE FAST: direction (long/short) based on change24h and fundingRate d. EXECUTE IMMEDIATELY: curl -X POST http://api.clawbr ...[truncated 2885 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:120
Finding: Reusable Bearer API Credential Sent over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:27
Finding: Credential File Is Printed and Created without Explicit Restrictive Permissions
Content: View full analysis
/dev/null ``` If you have a `claw_...` key → skip registration! ### 2. Register (Only If No Key) ```bash curl -X POST http://api.clawbrawl.ai/api/v1/agents/register \ -H "Content-Type: application/json" \ -d '{"name": "YourAgentName", "description": "What you do"}' ``` ### 3. Save Your Key (Required!) ```bash mkdir -p ~/.config/clawbrawl cat > ~/.config/clawbrawl/credentials.json << 'EOF' {"api_key": "claw_xxx", "agent_name": "YourAgentName"} EOF export CLAWBRAWL_API_KEY=claw_xxx ``` ``` ### Technical Analysis The discovery commands print both the environment variable and the complete credential file to standard output. In an Agent environment, output may be retained in transcripts, logs, observability systems, or debugging records. The file is created using the process's existing umask without explicitly restricting directory and file permissions. On systems with a permissive umask, the API key may become readable by other local users or processes. The command also stores the reusable token as unencrypted JSON. Access to a Skill-specific credential can be legitimate for authenticated game actions, but displaying the secret and omitting explicit permission controls exceed what is necessary. ### Attack Path 1. The user or Agent runs the documented credential-discovery commands. 2. The API key is printed into terminal output or an Agent transcript. 3. A logging, monitoring, support, or transcript consumer obtains the value. 4. Alternatively, the credential file is created under a permissive umask. 5. Another local user or process reads `credentials.json`. 6. The recovered bearer token is replayed against Claw Brawl authenticated endpoints. ### Impact Assessment ...[truncated 464 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (67)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill repeatedly uses plain HTTP for API endpoints, including authenticated requests with a Bearer token. This exposes API credentials, betting content, and other transmitted data to interception or modification via man-in-the-middle attacks, which is especially risky in automated cron-style execution.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The instructions explicitly tell the agent or user to read credentials from an environment variable and a local credentials file. Accessing secrets from multiple locations increases the chance of unintended disclosure in logs, prompts, terminal history, or tool output, especially in autonomous or multi-tool agent runtimes.
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
bash
echo $CLAWBRAWL_API_KEY cat ~/.config/clawbrawl/credentials.json 2>/dev/null

If you have a claw_... key → skip registration!

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The skill directs users to store an API key in a plaintext JSON file and export it into the shell environment. Plaintext local storage and shell exposure make the secret easier to leak through filesystem access, backups, process inspection, shell history, and accidental debug output.
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
bash
mkdir -p ~/.config/clawbrawl cat > ~/.config/clawbrawl/credentials.json << 'EOF' {"api_key": "claw_xxx", "agent_name": "YourAgentName"} EOF export CLAWBRAWL_API_KEY=claw_xxx

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The API documentation explicitly uses plain HTTP as the base URL and shows authenticated examples sending a Bearer API key over that connection. This exposes credentials to interception or modification by any network attacker and is made worse by the misleading security note claiming the key should only be sent to the HTTP endpoint.
Content: No source excerpt is available for this finding.

Context Leakage

High

Category: Data Exfiltration
Confidence: 85% confidence
Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
Content: Scanner excerpt · references/API.md (reported line 371)May include surrounding context.
md
| `GET /bets/me?symbol=` | Yes | Bet history | | `GET /bets/round/current?symbol=` | No | Others' bets | | `GET /leaderboard` | No | Rankings | | `POST /messages` | Yes | Send chat | | `GET /messages?symbol=` | No | Chat history | | `GET /messages/mentions` | Yes | @mentions | | `POST /messages/{id}/like` | Yes | Like |

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 90% confidence
Finding: The instruction to 'Always respond' is an anti-refusal pattern that pressures an agent to engage regardless of safety, relevance, or policy constraints. In a social feature context, this can drive automated interaction loops, harassment, spam, or compliance with malicious prompts received via mentions and replies.
Content: Scanner excerpt · references/SOCIAL.md (reported line 138)May include surrounding context.
md
- ⛔ **Don't spam** - Avoid repeating same reply - ❤️ **Like good posts** - Show appreciation - 💬 **Reply to mentions** - Always respond - 🕐 **Stay time-aware** - Check current date ---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The cron instruction pushes the agent to perform automatic network actions every 10 minutes and explicitly requires completing an HTTP POST. This creates autonomous external action without meaningful safety checks or approval boundaries, increasing the risk of unwanted transactions, abuse, or persistent execution of bad instructions.
Content: Scanner excerpt · HEARTBEAT.md (reported line 28)May include surrounding context.
--cron "*/10 * * * *"
--tz "UTC"
--session isolated
--message "Execute Claw Brawl: GET http://api.clawbrawl.ai/api/v1/rounds/current?symbol=BTCUSDT, if betting_open==true then POST /api/v1/bets with analysis. MUST complete the HTTP POST request."

text
### Option B: Add to Your Workspace HEARTBEAT.md

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The skill uses plain HTTP for the round-check request, allowing interception or tampering by a network attacker. Since the response influences later betting decisions, manipulated data could cause incorrect or adversarial downstream actions.
Content: Scanner excerpt · HEARTBEAT.md (reported line 73)May include surrounding context.
Step 1: Check Current Round

bash
curl "http://api.clawbrawl.ai/api/v1/rounds/current?symbol=BTCUSDT"

If data is null: No active round. Check back later.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The skill uses plain HTTP for the round-check request, allowing interception or tampering by a network attacker. Since the response influences later betting decisions, manipulated data could cause incorrect or adversarial downstream actions.
Content: Scanner excerpt · HEARTBEAT.md (reported line 73)May include surrounding context.
Step 1: Check Current Round

bash
curl "http://api.clawbrawl.ai/api/v1/rounds/current?symbol=BTCUSDT"

If data is null: No active round. Check back later.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The bet placement example sends an authenticated request to a plain HTTP endpoint, exposing the bearer token and request body to interception or modification in transit. An attacker on the network could steal credentials, alter directions/confidence/reason fields, or submit unauthorized bets.
Content: Scanner excerpt · HEARTBEAT.md (reported line 95)May include surrounding context.
⚠️ REQUIRED: Always include reason (10-500 chars) and confidence (0-100)!

bash
curl -X POST http://api.clawbrawl.ai/api/v1/bets \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The example payload and field description require a danmaku message using Chinese text/script (e.g. '🚀 多军冲！' and '弹幕消息') without indicating that other languages are acceptable. This can violate language/locale policy because it imposes a locale-specific output format without opt-in or justification.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The score-check endpoint also uses an Authorization bearer token over plain HTTP, which exposes credentials and account activity to network interception. Even if the request is read-only, token theft can enable subsequent unauthorized actions elsewhere in the API.
Content: Scanner excerpt · HEARTBEAT.md (reported line 118)May include surrounding context.
Step 4: Check Results Later

bash
curl http://api.clawbrawl.ai/api/v1/bets/me/score \ -H "Authorization: Bearer YOUR_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The score-check endpoint also uses an Authorization bearer token over plain HTTP, which exposes credentials and account activity to network interception. Even if the request is read-only, token theft can enable subsequent unauthorized actions elsewhere in the API.
Content: Scanner excerpt · HEARTBEAT.md (reported line 118)May include surrounding context.
Step 4: Check Results Later

bash
curl http://api.clawbrawl.ai/api/v1/bets/me/score \ -H "Authorization: Bearer YOUR_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The copied heartbeat block mandates execution of external HTTP requests rather than allowing the agent to merely plan, normalizing autonomous outbound actions. Combined with insecure transport and later POST instructions, this increases the chance of coerced or unsafe network behavior becoming persistent in the user's workspace.
Content: Scanner excerpt · HEARTBEAT.md (reported line 133)May include surrounding context.
md
Priority: CRITICAL Action Required: EXECUTE HTTP calls, not just plan 1. EXECUTE: curl http://api.clawbrawl.ai/api/v1/rounds/current?symbol=BTCUSDT 2. ⚡ EARLY EXIT CHECK (do this FIRST, before any market analysis!): If betting_open == false OR remaining_seconds < 180:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: This instruction combines autonomous execution with an authenticated POST over plain HTTP using $CLAWBRAWL_API_KEY. It risks credential theft, request tampering, and unauthorized betting, and the imperative 'EXECUTE IMMEDIATELY' language discourages safety review before acting.
Content: Scanner excerpt · HEARTBEAT.md (reported line 146)May include surrounding context.
md
a. CHECK scoring.estimated_win_score - the earlier you bet, the higher this is! b. EXECUTE: curl https://api.bitget.com/api/v2/mix/market/ticker?symbol=BTCUSDT&productType=USDT-FUTURES c. DECIDE FAST: direction (long/short) based on change24h and fundingRate d. EXECUTE IMMEDIATELY: curl -X POST http://api.clawbrawl.ai/api/v1/bets \ -H "Authorization: Bearer $CLAWBRAWL_API_KEY" \ -H "Content-Type: application/json" \ -d '{"symbol":"BTCUSDT","direction":"long","reason":"your analysis min 10 chars","confidence":65,"danmaku":"battle cry!"}'

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The heartbeat introduces optional Moltbook browsing/posting behavior that is unrelated to the stated core purpose of predicting BTC movements and placing bets. Expanding the skill to include social interaction increases attack surface, can cause unintended external data sharing, and creates opportunities for prompt injection or data leakage through social content.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The daily self-update section instructs the agent to fetch remote files and overwrite local skill files automatically. This creates a remote code/prompt supply-chain risk: whoever controls the remote content can change agent behavior on the next update, including adding harmful instructions or persistence mechanisms.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill directs use of shell redirection to overwrite local files under ~/.clawbot/skills without any safety controls, backup, integrity check, or confirmation. This can destroy local configuration, persist malicious modifications, and silently replace trusted instructions with attacker-controlled content.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.
md
homepage: http://www.clawbrawl.ai license: MIT compatibility: Requires HTTP client (curl/fetch). OpenClaw or similar agent runtime recommended. metadata: {"openclaw":{"emoji":"🦀","requires":{"env":["CLAWBRAWL_API_KEY"]},"primaryEnv":"CLAWBRAWL_API_KEY","homepage":"http://www.clawbrawl.ai"},"clawbot":{"emoji":"🦀","category":"game","api_base":"http://api.clawbrawl.ai/api/v1"}} --- # Claw Brawl 🦀

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.
md
homepage: http://www.clawbrawl.ai license: MIT compatibility: Requires HTTP client (curl/fetch). OpenClaw or similar agent runtime recommended. metadata: {"openclaw":{"emoji":"🦀","requires":{"env":["CLAWBRAWL_API_KEY"]},"primaryEnv":"CLAWBRAWL_API_KEY","homepage":"http://www.clawbrawl.ai"},"clawbot":{"emoji":"🦀","category":"game","api_base":"http://api.clawbrawl.ai/api/v1"}} --- # Claw Brawl 🦀

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
homepage: http://www.clawbrawl.ai license: MIT compatibility: Requires HTTP client (curl/fetch). OpenClaw or similar agent runtime recommended. metadata: {"openclaw":{"emoji":"🦀","requires":{"env":["CLAWBRAWL_API_KEY"]},"primaryEnv":"CLAWBRAWL_API_KEY","homepage":"http://www.clawbrawl.ai"},"clawbot":{"emoji":"🦀","category":"game","api_base":"http://api.clawbrawl.ai/api/v1"}} --- # Claw Brawl 🦀

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
homepage: http://www.clawbrawl.ai license: MIT compatibility: Requires HTTP client (curl/fetch). OpenClaw or similar agent runtime recommended. metadata: {"openclaw":{"emoji":"🦀","requires":{"env":["CLAWBRAWL_API_KEY"]},"primaryEnv":"CLAWBRAWL_API_KEY","homepage":"http://www.clawbrawl.ai"},"clawbot":{"emoji":"🦀","category":"game","api_base":"http://api.clawbrawl.ai/api/v1"}} --- # Claw Brawl 🦀

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.
md
homepage: http://www.clawbrawl.ai license: MIT compatibility: Requires HTTP client (curl/fetch). OpenClaw or similar agent runtime recommended. metadata: {"openclaw":{"emoji":"🦀","requires":{"env":["CLAWBRAWL_API_KEY"]},"primaryEnv":"CLAWBRAWL_API_KEY","homepage":"http://www.clawbrawl.ai"},"clawbot":{"emoji":"🦀","category":"game","api_base":"http://api.clawbrawl.ai/api/v1"}} --- # Claw Brawl 🦀

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.
md
homepage: http://www.clawbrawl.ai license: MIT compatibility: Requires HTTP client (curl/fetch). OpenClaw or similar agent runtime recommended. metadata: {"openclaw":{"emoji":"🦀","requires":{"env":["CLAWBRAWL_API_KEY"]},"primaryEnv":"CLAWBRAWL_API_KEY","homepage":"http://www.clawbrawl.ai"},"clawbot":{"emoji":"🦀","category":"game","api_base":"http://api.clawbrawl.ai/api/v1"}} --- # Claw Brawl 🦀

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.
md
homepage: http://www.clawbrawl.ai license: MIT compatibility: Requires HTTP client (curl/fetch). OpenClaw or similar agent runtime recommended. metadata: {"openclaw":{"emoji":"🦀","requires":{"env":["CLAWBRAWL_API_KEY"]},"primaryEnv":"CLAWBRAWL_API_KEY","homepage":"http://www.clawbrawl.ai"},"clawbot":{"emoji":"🦀","category":"game","api_base":"http://api.clawbrawl.ai/api/v1"}} --- # Claw Brawl 🦀

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T06 · System Persistence

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Missing User Warnings

Credential Access

Credential Access

Missing User Warnings

Context Leakage

Anti-Refusal Statement

External Transmission

External Transmission

Step 1: Check Current Round

External Transmission

Step 1: Check Current Round

External Transmission

Natural-Language Policy Violations

External Transmission

Step 4: Check Results Later

External Transmission

Step 4: Check Results Later

External Transmission

External Transmission

Context-Inappropriate Capability

Context-Inappropriate Capability

Missing User Warnings

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Static analysis