Security audit

PredictClash

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a prediction-game purpose, but it auto-registers an external account and persists bearer tokens/history locally without a clear user consent step.

Review this skill before installing if you do not want an agent to create a Predict Clash account automatically or save a reusable API token under your OpenClaw workspace. Use a scoped token where possible, remove the .token and history files when finished, and avoid putting sensitive information in prediction reasoning because it is submitted to the external service.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.
md
echo "[$(date -Iseconds)] STEP 0.5: Checking new results..." >> "$LOGFILE" HISTORY="$HOME/.openclaw/workspace/skills/predictclash/history.jsonl" PREV=$(curl -s --connect-timeout 10 --max-time 30 \ "$API/agents/me/history" \ -H "Authorization: Bearer $TOKEN") if [ -n "$PREV" ] && echo "$PREV" | python3 -c "import sys,json; json.load(sys.stdin)" 2>/dev/null; then

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill documentation claims capabilities beyond the stated purpose of joining assigned prediction rounds, including registration. That scope expansion matters because it authorizes account lifecycle actions the user may not expect, increasing the chance of unauthorized external actions and data creation on the remote service.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill reads tokens from an environment variable and persists them in a local dotfile, creating a reusable credential store on disk. Storing long-lived bearer tokens outside a dedicated secret manager increases exposure through local file compromise, backup leakage, or accidental reuse by other processes.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Automatically self-registering a new agent when no valid token exists exceeds the expected workflow of using an existing account to answer assigned questions. This can create unintended accounts, trigger remote side effects without explicit user approval, and obscure which identity is being used on the service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill stores authentication tokens and history on disk without a clear user warning, which undermines informed consent for sensitive data handling. Hidden credential persistence is especially risky because users may assume gameplay actions are ephemeral while the skill creates reusable local artifacts.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: The skill transmits prediction payloads and a bearer token to an external service. External transmission is expected for this skill’s function, but it still represents a real security-relevant boundary because reasoning text, identifiers, and credentials are sent off-host, and any compromise or misuse of the endpoint affects confidentiality and account integrity.
Content: Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.
md
echo "[$(date -Iseconds)] STEP 1: Empty prediction payload" >> "$LOGFILE" echo "No predictions to submit"; exit 1 fi PRED_RESP=$(curl -s --connect-timeout 10 --max-time 30 -w "\n%{http_code}" -X POST "$API/challenge" \ -H "Content-Type: application/json" -H "Authorization: Bearer $TOKEN" -d "$PRED_PAYLOAD") PRED_CODE=$(echo "$PRED_RESP" | tail -1) echo "[$(date -Iseconds)] STEP 1: HTTP $PRED_CODE" >> "$LOGFILE"

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Advertising topic/round proposal functionality broadens the effective authority of the skill beyond its declared role of joining assigned rounds. Even if only mentioned in reference text, it can normalize or later enable unrelated outbound actions against the remote service without users understanding that expanded scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The example question specifies a deadline/time reference in "KST," which introduces a specific locale/timezone in the skill description without offering alternatives or explaining why that locale is required. This can be a natural-language locale policy issue because users may infer the skill operates in a fixed locale by default.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest says to use the skill when the user wants to participate in prediction games, which is a broad natural-language trigger without clear boundaries or exclusions. It does not specify exact invocation phrases, contexts, or negative examples, so it could overlap with general conversation about games or predictions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Several table entries and labels are written in Korean while the rest of the document is in English, and the skill does not ask for or offer a language preference. This can impose a locale/language experience on users without opt-in, which matches the language-policy category.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The manifest describes joining prediction rounds and submitting predictions, but this code additionally builds a persistent local history file containing score, rank, title, and timestamps. That retention and strategy-tracking capability is not necessary to understand from the manifest and extends the skill into local analytics/state management.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.