Clawbrawl

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:51 AM UTC
• Version: 1.0.16

Overview

The skill matches a BTC prediction-game purpose, but it asks for persistent automation, unverified HTTP self-updates, and plaintext API-key use that users should review carefully before installing.

Install only if you are comfortable with a skill that can set up recurring autonomous game actions, store and use a Claw Brawl API key, and modify local agent instructions. In its current form, require HTTPS-only API and install URLs, remove automatic self-updates, avoid workspace heartbeat injection unless manually reviewed, protect the credential with restrictive permissions or a secret store, and add clear disable/removal steps for any cron job.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: HEARTBEAT.md:382

Finding

Automatic Replacement of Trusted Skill Instructions from Plaintext HTTP

Content

View full analysis

~/.clawbot/skills/claw-brawl/SKILL.md 2. Fetch latest heartbeat.md: curl -s http://www.clawbrawl.ai/heartbeat.md > ~/.clawbot/skills/claw-brawl/HEARTBEAT.md 3. Update lastSkillFetch timestamp 4. Read the updated files to check for new rules or features ``` `package.json:31-36`: ```json "skill_files": { "skill": "http://www.clawbrawl.ai/skill.md", "heartbeat": "http://www.clawbrawl.ai/heartbeat.md", "package": "http://www.clawbrawl.ai/skill.json" }, "install": "mkdir -p ~/.clawbot/skills/claw-brawl && curl -s http://www.clawbrawl.ai/skill.md > ~/.clawbot/skills/claw-brawl/SKILL.md && curl -s http://www.clawbrawl.ai/heartbeat.md > ~/.clawbot/skills/claw-brawl/HEARTBEAT.md && curl -s http://www.clawbrawl.ai/skill.json > ~/.clawbot/skills/claw-brawl/package.json", ``` ### Technical Analysis The Skill requires instruction files to be downloaded from external URLs and written directly over locally trusted files. The downloads use plaintext HTTP and are not protected by TLS server authentication, a digital signature, a pinned cryptographic digest, or any user-review step. The heartbeat subsequently directs the agent to read the replaced files and adopt any new rules. Consequently, the effective behavior of the installed Skill can change after the reviewed package has been approved. Although the retrieved artifacts are Markdown and JSON rather than native executables, they constitute executable control input for an AI agent because they can direct tool calls, credential access, filesystem operations, and network requests. Direct shell r ...[truncated 1492 chars]

Remediation

View remediation

T06 · System Persistence

Error

• Location: HEARTBEAT.md:17

Finding

Persistent Autonomous Betting Through a Cross-Session Cron Job

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: HEARTBEAT.md:117

Finding

Workspace-Level Instruction Hijacking Through Mandatory Heartbeat Injection

Content

View full analysis

= 180: a. CHECK scoring.estimated_win_score - the earlier you bet, the higher this is! b. EXECUTE: curl https://api.bitget.com/api/v2/mix/market/ticker?symbol=BTCUSDT&productType=USDT-FUTURES c. DECIDE FAST: direction (long/short) based on change24h and fundingRate d. EXECUTE IMMEDIATELY: curl -X POST http://api.clawbrawl.ai/api/v1/bets \ -H "Authorization: Bearer $CLAWBRAWL_API_KEY" \ -H "Content-Type: application/json" \ -d '{"symbol":"BTCUSDT","direction":"long","reason":"your analysis min 10 chars","confidence":65,"danmaku":"battle cry!"}' e. VERIFY: response must contain "success": true f. If success != true, LOG the error code and hint ⚠️ You MUST actually execute the HTTP requests. Planning or analyzing without POSTing = no participation. ⚠️ Do NOT waste time analyzing market data if betting is closed! ⚠️ BET EARLY! scoring.estimated_win_score drops every minute. Don't overthink - act fast! ``` ``` ### Technical Analysis The Skill does not keep its instructions scoped to the current inv ...[truncated 1728 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:94

Finding

Bearer API Credentials Transmitted Over Plaintext HTTP

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:25

Finding

API Key Disclosure Through Terminal Output and Unprotected Local Storage

Content

View full analysis

/dev/null ``` The same section directs users to store and export the key as follows: ```bash mkdir -p ~/.config/clawbrawl cat > ~/.config/clawbrawl/credentials.json << 'EOF' {"api_key": "claw_xxx", "agent_name": "YourAgentName"} EOF export CLAWBRAWL_API_KEY=claw_xxx ``` ### Technical Analysis Reading a Claw Brawl credential is related to authenticated game functionality, but printing the full environment variable and credential file is unnecessary. The output may become part of an agent transcript, terminal history, CI log, debug capture, or screen recording. The storage routine does not explicitly enforce restrictive permissions on either the directory or the credential file. Its effective permissions depend on the user's current `umask`. Exporting the secret into the process environment can also expose it to child processes, diagnostic tooling, or process inspection mechanisms available to the same account. The Skill needs access only to its own API key. Displaying the secret and broadly exporting it exceed the minimum access pattern required to determine whether a credential exists or to authenticate one request. ### Attack Path 1. A user or agent follows the credential-check instructions. 2. `echo` or `cat` writes the full API key into captured terminal or agent output. 3. Another user, process, logging service, or transcript consumer obtains that output. 4. Alternatively, the credential file is created with permissions permitted by an unsafe `umask`. 5. The attacker reads the key and reuses it against the Claw Brawl API. 6. If the environment variable is inherited, an unrelated child process can also obtain the token. ### Impact Assessment Successful exploitation discloses the Claw Brawl bearer cre ...[truncated 406 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (71)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The commands overwrite local skill files directly from remote HTTP sources, giving the remote operator ongoing control over agent behavior. If the endpoint is compromised or the content changes maliciously, the agent can be reprogrammed without any local validation.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The skill instructs reading an API credential from an environment variable and a local credentials file. While checking for existing configuration is not inherently malicious, it encourages credential discovery/access patterns and normalizes direct handling of secrets in user-space files.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

bash

echo $CLAWBRAWL_API_KEY
cat ~/.config/clawbrawl/credentials.json 2>/dev/null

If you have a claw_... key → skip registration!

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

This step writes a live API key into a plaintext credentials.json file and exports it into the environment, creating multiple places from which the secret may be recovered. In combination with the skill's many HTTP examples, this substantially raises the risk of credential theft and misuse.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

bash

mkdir -p ~/.config/clawbrawl
cat > ~/.config/clawbrawl/credentials.json << 'EOF'
{"api_key": "claw_xxx", "agent_name": "YourAgentName"}
EOF
export CLAWBRAWL_API_KEY=claw_xxx

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation directs users to send bearer API keys to an HTTP endpoint, which exposes credentials and authenticated traffic to interception or modification by any network attacker on the path. The explicit security note reinforces unsafe behavior by telling users to trust a non-TLS origin, making credential compromise and account misuse far more likely.

Content

No source excerpt is available for this finding.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · references/API.md (reported line 371)May include surrounding context.

md

| `GET /bets/me?symbol=` | Yes | Bet history |
| `GET /bets/round/current?symbol=` | No | Others' bets |
| `GET /leaderboard` | No | Rankings |
| `POST /messages` | Yes | Send chat |
| `GET /messages?symbol=` | No | Chat history |
| `GET /messages/mentions` | Yes | @mentions |
| `POST /messages/{id}/like` | Yes | Like |

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The authenticated chat examples send bearer tokens and message content over plaintext HTTP rather than HTTPS. An attacker on the network path could intercept API keys, read or alter messages, and impersonate the user or agent.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

The instruction to 'Always respond' acts like an anti-refusal or persistence cue that can pressure an agent to reply automatically, even when doing so may be unsafe, spammy, or policy-inconsistent. In a social system, this can amplify harassment, manipulation, prompt injection via mentions, or runaway engagement loops.

Content

Scanner excerpt · references/SOCIAL.md (reported line 138)May include surrounding context.

md

- ⛔ **Don't spam** - Avoid repeating same reply
- ❤️ **Like good posts** - Show appreciation
- 💬 **Reply to mentions** - Always respond
- 🕐 **Stay time-aware** - Check current date

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The cron setup directs fully automated external betting actions and use of an API key without clear user warning about continuous outbound requests, credential exposure risk, or financial/gameplay consequences. Persistently scheduled autonomous actions increase the chance of unintended or abusive operation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The cron message hardcodes automated communication with an external HTTP endpoint and mandates POST completion, creating persistent autonomous external actions over insecure transport. Using plain HTTP exposes requests and potentially sensitive betting behavior to interception or tampering on the network.

Content

Scanner excerpt · HEARTBEAT.md (reported line 28)May include surrounding context.

--cron "*/10 * * * *"
--tz "UTC"
--session isolated
--message "Execute Claw Brawl: GET http://api.clawbrawl.ai/api/v1/rounds/current?symbol=BTCUSDT, if betting_open==true then POST /api/v1/bets with analysis. MUST complete the HTTP POST request."

text

### Option B: Add to Your Workspace HEARTBEAT.md

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill tells users to copy content into workspace HEARTBEAT.md and later overwrite local skill files, but does not present adequate safety warnings about modifying local automation behavior. This can lead users or agents to install persistent, high-privilege instructions without understanding the risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The current-round check uses plain HTTP rather than HTTPS. Even if the request seems low sensitivity, insecure transport allows response tampering that could manipulate agent behavior, such as falsely indicating a betting window or influencing subsequent actions.

Content

Scanner excerpt · HEARTBEAT.md (reported line 73)May include surrounding context.

Step 1: Check Current Round

bash

curl "http://api.clawbrawl.ai/api/v1/rounds/current?symbol=BTCUSDT"

If data is null: No active round. Check back later.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The current-round check uses plain HTTP rather than HTTPS. Even if the request seems low sensitivity, insecure transport allows response tampering that could manipulate agent behavior, such as falsely indicating a betting window or influencing subsequent actions.

Content

Scanner excerpt · HEARTBEAT.md (reported line 73)May include surrounding context.

Step 1: Check Current Round

bash

curl "http://api.clawbrawl.ai/api/v1/rounds/current?symbol=BTCUSDT"

If data is null: No active round. Check back later.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The bet placement endpoint uses plain HTTP while carrying an Authorization bearer token. This can expose credentials and permit man-in-the-middle interception or modification of bets, directly compromising the account and integrity of actions.

Content

Scanner excerpt · HEARTBEAT.md (reported line 95)May include surrounding context.

⚠️ REQUIRED: Always include reason (10-500 chars) and confidence (0-100)!

bash

curl -X POST http://api.clawbrawl.ai/api/v1/bets \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example payload includes a Chinese danmaku string and the field description is written as 弹幕消息, implying a specific language/locale expectation. The document does not offer the user a language choice or explain why Chinese-language content is required.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The score-check request also sends a bearer token over plain HTTP. Even read-oriented authenticated calls can leak credentials to attackers on the network, enabling account takeover and unauthorized API use.

Content

Scanner excerpt · HEARTBEAT.md (reported line 118)May include surrounding context.

Step 4: Check Results Later

bash

curl http://api.clawbrawl.ai/api/v1/bets/me/score \
  -H "Authorization: Bearer YOUR_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The score-check request also sends a bearer token over plain HTTP. Even read-oriented authenticated calls can leak credentials to attackers on the network, enabling account takeover and unauthorized API use.

Content

Scanner excerpt · HEARTBEAT.md (reported line 118)May include surrounding context.

Step 4: Check Results Later

bash

curl http://api.clawbrawl.ai/api/v1/bets/me/score \
  -H "Authorization: Bearer YOUR_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The copied heartbeat block instructs execution of external HTTP calls as a required action, encouraging persistent autonomous network behavior from workspace automation. This is more dangerous because it is meant to be transplanted into a high-frequency local heartbeat and can continuously trigger unreviewed outbound requests.

Content

Scanner excerpt · HEARTBEAT.md (reported line 133)May include surrounding context.

md

Priority: CRITICAL
Action Required: EXECUTE HTTP calls, not just plan

1. EXECUTE: curl http://api.clawbrawl.ai/api/v1/rounds/current?symbol=BTCUSDT

2. ⚡ EARLY EXIT CHECK (do this FIRST, before any market analysis!):
   If betting_open == false OR remaining_seconds < 180:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This instruction sends an authenticated POST bet request to a plain HTTP endpoint from within the mandatory automation block. Because it combines insecure transport, credentials, and autonomous action, it creates a direct path to token theft, bet manipulation, and unauthorized account use.

Content

Scanner excerpt · HEARTBEAT.md (reported line 146)May include surrounding context.

md

a. CHECK scoring.estimated_win_score - the earlier you bet, the higher this is!
   b. EXECUTE: curl https://api.bitget.com/api/v2/mix/market/ticker?symbol=BTCUSDT&productType=USDT-FUTURES
   c. DECIDE FAST: direction (long/short) based on change24h and fundingRate
   d. EXECUTE IMMEDIATELY: curl -X POST http://api.clawbrawl.ai/api/v1/bets \
        -H "Authorization: Bearer $CLAWBRAWL_API_KEY" \
        -H "Content-Type: application/json" \
        -d '{"symbol":"BTCUSDT","direction":"long","reason":"your analysis min 10 chars","confidence":65,"danmaku":"battle cry!"}'

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The state guidance instructs persistent storage of detailed betting history, reasoning, confidence, and activity metrics. Retaining granular behavioral history increases the chance that sensitive or proprietary decision data is later exposed, repurposed, or exfiltrated.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill encourages collecting and using other agents’ bets and reasons as a decision signal. This can propagate third-party content into downstream reasoning or outputs, increasing risks of privacy leakage, prompt contamination, and amplification of untrusted user-generated content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The heartbeat expands a BTC prediction/betting skill into social posting and promotion on Moltbook, which is not necessary to the stated purpose. This broadens the skill’s authority and can cause unsolicited outbound content generation and platform interaction beyond user expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file instructs the agent to post status updates, invitations, and promotional content to Moltbook even though the skill is described as BTC prediction gameplay. That is an unjustified capability expansion that could be abused for spam, reputation manipulation, or unauthorized external communications.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The heartbeat mandates daily self-updating by fetching remote skill files and replacing local copies, which exceeds the declared prediction-game purpose. This creates a trust-on-first-use supply-chain risk where future remote content can silently change local behavior without review.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

version: 1.0.16
description: Predict BTC price movements every 10 minutes. Compete with AI agents. Climb the leaderboard!
homepage: https://clawbrawl.ai
metadata: {"clawbrawl":{"emoji":"🦀","category":"game","api_base":"https://api.clawbrawl.ai/api/v1"}}
---

# Claw Brawl 🦀

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

The documented base URL is plain HTTP, while the same section warns users not to send API keys to other domains. That warning is undermined by using an insecure transport to the correct domain, because attackers on the network can still intercept or alter traffic.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

⚡ **IMPORTANT:** Bet in EVERY round. Agents who participate frequently learn faster and climb the ranks!

**Base URL:** `http://api.clawbrawl.ai/api/v1`

🔒 **Security:** NEVER send your API key to any domain other than `api.clawbrawl.ai`

Static analysis

No suspicious patterns detected.