ClawHub
Back to skill

Security audit

Epic Free Games

Security checks for vulnerabilities and agentic risk

Overview

The skill automates an authenticated Epic Games checkout while storing reusable login state and includes anti-detection guidance, so users should review it carefully before installing.

Install only if you are comfortable with a skill storing your Epic login session locally and automatically completing store checkout actions. Prefer reviewing and modifying it first to remove Cloudflare anti-detection guidance, pin dependencies, protect or delete epic_auth.json, add the missing .gitignore, and require explicit confirmation plus zero-price verification before any order is submitted.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:113
Finding

Unpinned Global npm Dependency Creates a Supply-Chain Risk

Content
View full analysis
Remediation
View remediation
``` 2. Prefer a project-local dependency and invoke it through a package script or `npx --no-install` rather than installing it globally. 3. Commit and enforce a lockfile with package integrity values. 4. Document the expected npm registry, package publisher, source repository, and reviewed release checksum. 5. Disable npm lifecycle scripts during installation where feasible, then run only explicitly reviewed setup operations. 6. Avoid elevated installation unless it is strictly necessary. 7. Establish a process to review and test dependency upgrades before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/claim.py:63
Finding

Reusable Browser Authentication State Is Stored Without Enforced Access Controls

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/claim.py:281
Finding

Broad Button Matching Can Confirm an Unvalidated Transaction

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill documents direct shell-based execution (python, npm, agent-browser) but does not declare an explicit tool scope such as allowed tools or permissions. This weakens containment and reviewability, making it easier for an agent runtime to execute broader command capabilities than users may expect.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document first states that hCaptcha/Cloudflare cannot be bypassed automatically, but later supplies anti-detection steps intended to avoid triggering those defenses. This contradiction is risky because it normalizes circumvention behavior while presenting the skill as safety-conscious, potentially misleading users and reviewers.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

These instructions go beyond ordinary browser automation and provide anti-detection guidance (--disable-blink-features=AutomationControlled) to reduce the chance that Cloudflare detects automation. That meaningfully increases the risk that the skill is used to circumvent platform bot protections rather than merely automate a user-visible workflow.

Content

No source excerpt is available for this finding.

Ssd 2

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill includes explicit anti-detection guidance for automating a site in a way that avoids bot detection signals. Even if framed as troubleshooting, this is dangerous because it facilitates evasion of platform security controls protecting an authenticated transaction flow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documented command hard-codes the zh-CN storefront URL, which imposes a specific language/locale in the skill instructions. The file does not offer an opt-in choice of locale or explain why the skill must be limited to Chinese, so this is a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Ssd 2

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

These troubleshooting steps recommend using arguments specifically described as preventing detection by Cloudflare. That directly supports bypassing defensive controls and can enable scaling of unauthorized automated interactions against a third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This troubleshooting example again directs users to https://store.epicgames.com/zh-CN/free-games, enforcing a Chinese locale in the skill guidance. Repeating a fixed locale without presenting alternatives or justification violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Ssd 4

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The end-to-end workflow combines manual login/trust establishment with stealth-oriented automation to complete a protected purchase/claim transaction and save persistent auth state. In context, this materially raises abuse potential because it operationalizes repeatable automation against an authenticated commerce flow while reducing detection and preserving session access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The end-to-end example instructs users to open the zh-CN Epic Games URL, which is a language/locale-specific directive. Because the skill does not state that it is a China-specific tool or let users select another locale, this is a policy-relevant language constraint.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/claim.py (reported line 45)May include surrounding context.

python
cmd = [browser_path, "--session", session] + args
    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script saves persistent Epic authentication state to epic_auth.json on disk, but it does not warn the user about the sensitivity of that file or enforce restrictive file permissions. If another local user, malware, or a synced backup process accesses that file, the Epic session could be reused to access the account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script automatically clicks the final 'Place Order' button for the user's logged-in account without a just-in-time confirmation step. Even though the target is intended to be free items, this is still an account-affecting transaction and could misfire if page matching is wrong, the page changes, or a non-free item is selected.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The developer security section says *.png files should never appear in the distribution because screenshots may contain sensitive information. Elsewhere, the usage example instructs the user to run agent-browser ... screenshot, creating such files as part of the normal workflow without clarifying handling, which creates conflicting operational guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script forces use of the zh-CN Epic Games storefront URL, which imposes a specific locale by default. There is no user opt-in, locale selection option, or justification that this skill is intended only for Chinese-language/regional use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.