ClawHub
Back to skill

Security audit

PredictClash

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a prediction-game purpose, but it auto-registers an external account and persists bearer tokens/history locally without a clear user consent step.

Review this skill before installing if you do not want an agent to create a Predict Clash account automatically or save a reusable API token under your OpenClaw workspace. Use a scoped token where possible, remove the .token and history files when finished, and avoid putting sensitive information in prediction reasoning because it is submitted to the external service.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

External Script Fetching

High
Category
Supply Chain
Content
echo "[$(date -Iseconds)] STEP 0.5: Checking new results..." >> "$LOGFILE"
HISTORY="$HOME/.openclaw/workspace/skills/predictclash/history.jsonl"

PREV=$(curl -s --connect-timeout 10 --max-time 30 \
  "$API/agents/me/history" \
  -H "Authorization: Bearer $TOKEN")
if [ -n "$PREV" ] && echo "$PREV" | python3 -c "import sys,json; json.load(sys.stdin)" 2>/dev/null; then
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill documentation claims capabilities beyond the stated purpose of joining assigned prediction rounds, including registration. That scope expansion matters because it authorizes account lifecycle actions the user may not expect, increasing the chance of unauthorized external actions and data creation on the remote service.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill reads tokens from an environment variable and persists them in a local dotfile, creating a reusable credential store on disk. Storing long-lived bearer tokens outside a dedicated secret manager increases exposure through local file compromise, backup leakage, or accidental reuse by other processes.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
Automatically self-registering a new agent when no valid token exists exceeds the expected workflow of using an existing account to answer assigned questions. This can create unintended accounts, trigger remote side effects without explicit user approval, and obscure which identity is being used on the service.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill stores authentication tokens and history on disk without a clear user warning, which undermines informed consent for sensitive data handling. Hidden credential persistence is especially risky because users may assume gameplay actions are ephemeral while the skill creates reusable local artifacts.

External Transmission

Medium
Category
Data Exfiltration
Content
echo "[$(date -Iseconds)] STEP 1: Empty prediction payload" >> "$LOGFILE"
  echo "No predictions to submit"; exit 1
fi
PRED_RESP=$(curl -s --connect-timeout 10 --max-time 30 -w "\n%{http_code}" -X POST "$API/challenge" \
  -H "Content-Type: application/json" -H "Authorization: Bearer $TOKEN" -d "$PRED_PAYLOAD")
PRED_CODE=$(echo "$PRED_RESP" | tail -1)
echo "[$(date -Iseconds)] STEP 1: HTTP $PRED_CODE" >> "$LOGFILE"
Confidence
92% confidence
Finding
The skill transmits prediction payloads and a bearer token to an external service. External transmission is expected for this skill’s function, but it still represents a real security-relevant boundary because reasoning text, identifiers, and credentials are sent off-host, and any compromise or misuse of the endpoint affects confidentiality and account integrity.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
Advertising topic/round proposal functionality broadens the effective authority of the skill beyond its declared role of joining assigned rounds. Even if only mentioned in reference text, it can normalize or later enable unrelated outbound actions against the remote service without users understanding that expanded scope.

Natural-Language Policy Violations

Low
Confidence
78% confidence
Finding
The example question specifies a deadline/time reference in "KST," which introduces a specific locale/timezone in the skill description without offering alternatives or explaining why that locale is required. This can be a natural-language locale policy issue because users may infer the skill operates in a fixed locale by default.

Vague Triggers

Low
Confidence
85% confidence
Finding
The manifest says to use the skill when the user wants to participate in prediction games, which is a broad natural-language trigger without clear boundaries or exclusions. It does not specify exact invocation phrases, contexts, or negative examples, so it could overlap with general conversation about games or predictions.

Natural-Language Policy Violations

Low
Confidence
88% confidence
Finding
Several table entries and labels are written in Korean while the rest of the document is in English, and the skill does not ask for or offer a language preference. This can impose a locale/language experience on users without opt-in, which matches the language-policy category.

Context-Inappropriate Capability

Low
Confidence
80% confidence
Finding
The manifest describes joining prediction rounds and submitting predictions, but this code additionally builds a persistent local history file containing score, rank, title, and timestamps. That retention and strategy-tracking capability is not necessary to understand from the manifest and extends the skill into local analytics/state management.

Static analysis

No suspicious patterns detected.