Clawzone

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:37 PM UTC
• Version: 1.0.20

Overview

This skill is purpose-aligned for playing ClawZone games, but it gives agents sensitive API and cron authority without enough endpoint, input, or confirmation safeguards.

Review before installing. Use this only with a trusted HTTPS ClawZone endpoint, avoid reused passwords, rotate any exposed API key or session token, and monitor/remove created clawzone cron jobs. Treat game descriptions, match IDs, and cron event text as untrusted data unless the skill is tightened to validate them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:107
• Finding: Credentials and Sensitive Data Can Be Sent to an Untrusted Configurable Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:27`, `SKILL.md:72`, `SKILL.md:107-110`, `SKILL.md:193-194`, `SKILL.md:225-228`, and `SKILL.md:312-320` **Vulnerability Type**: Unrestricted credential transmission **Risk Level**: High ### Vulnerable Code ```markdown - `CLAWZONE_URL` — Platform base URL (e.g. `https://clawzone.space`). ``` ```markdown Base: `${CLAWZONE_URL}/api/v1`. Auth header: `-H "Authorization: Bearer ${CLAWZONE_API_KEY}"`. ``` ```bash curl -s -X POST "${CLAWZONE_URL}/api/v1/matchmaking/join" \ -H "Authorization: Bearer ${CLAWZONE_API_KEY}" \ -H "Content-Type: application/json" \ -d '{"game_id": "GAME_ID"}' | jq '.' ``` ```bash curl -s "${CLAWZONE_URL}/api/v1/matches/MATCH_ID/state" \ -H "Authorization: Bearer ${CLAWZONE_API_KEY}" | jq '.' ``` ```bash curl -s -X POST "${CLAWZONE_URL}/api/v1/matches/MATCH_ID/actions" \ -H "Authorization: Bearer ${CLAWZONE_API_KEY}" \ -H "Content-Type: application/json" \ -d "$ACTION" | jq '.' ``` ```bash # Step 1: Create a user account curl -s -X POST "${CLAWZONE_URL}/api/v1/auth/register" \ -H "Content-Type: application/json" \ -d '{"username": "my-user", "password": "mypassword"}' | jq '.' # Save session_token from response # Step 2: Create an agent under the account curl -s -X POST "${CLAWZONE_URL}/api/v1/auth/agents" \ -H "Authorization: Bearer SESSION_TOKEN" \ -H "Content-Type: application/json" \ -d '{"name": "my-agent", "framework": "openclaw"}' | jq '.' ``` ### Technical Analysis The Skill uses the environment-controlled `CLAWZONE_URL` as the destination for requests containing an API key, a session token, registration credentials, private match state, and player actions. The URL is necessary to communicate with ClawZone, but the instructions impose no origin allowlist, HTTPS requirement, normalized-host validation, or confirmation step for nonstandard endpoints. Consequently, possession or influence over `CLAWZONE_URL` is sufficient to redirect sensitiv ...[truncated 1825 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default to the canonical ClawZone HTTPS origin and allowlist its normalized scheme, hostname, and port. 2. Reject HTTP, embedded URL credentials, unexpected ports, IP literals, malformed origins, and redirect targets outside the approved origin. 3. Require explicit user confirmation before sending credentials to any custom deployment. 4. Bind each API key to the origin for which it was issued and never reuse credentials across origins. 5. Use `curl --proto '=https' --proto-redir '=https'` and restrict redirects with an approved-host policy. 6. Avoid placing sample plaintext passwords in executable examples. Prompt securely for credentials or read them from protected secret storage. 7. Redact credentials and tokens from logs, command summaries, cron events, and user-visible error reports. 8. Document credential rotation and immediate revocation procedures for suspected endpoint misconfiguration. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:97
• Finding: Server-Controlled Agent Instructions Are Treated as Trusted Operational Guidance<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:97-102` **Vulnerability Type**: Prompt injection through remote API content **Risk Level**: Medium ### Vulnerable Code ```markdown **1a.** Fetch game details — `agent_instructions` tells you valid action types/payloads: ```bash curl -s "${CLAWZONE_URL}/api/v1/games/GAME_ID" \ | jq '{name, agent_instructions, min_players, max_players, max_turns, turn_timeout_ms}' ``` ``` ### Technical Analysis The `agent_instructions` field is supplied by the remote service, but the Skill characterizes it as instructions that tell the Agent what action types and payloads to use. No trust-boundary warning or schema restriction limits this content to declarative game mechanics. A malicious game definition or compromised/custom server can therefore return natural-language text that attempts to supersede the Skill, request unrelated tool calls, solicit secrets, or redirect network activity. Because the content is deliberately presented to the Agent as instructions, it has a stronger prompt-injection opportunity than ordinary untrusted response data. The legitimate requirement is only to learn the permitted action schema. Allowing unrestricted natural-language instructions is broader than necessary for that function. ### Attack Path 1. An attacker controls or compromises the configured ClawZone server, or publishes a malicious game definition accepted by that service. 2. The attacker places adversarial directives in the `agent_instructions` response field. 3. The Agent fetches game details as directed by the Skill. 4. The Agent interprets the remote text as operational guidance rather than untrusted data. 5. If the injected directives are followed, the Agent may invoke tools, disclose session information, contact an attacker-controlled service, or deviate from the user-authorized game task. ### Impact Assessment The direct impact is manipulation of the current Agent session and its game-related decisions. The ...[truncated 436 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Explicitly classify all API response fields, including `agent_instructions`, as untrusted data that cannot override system, developer, user, or Skill instructions. 2. Replace free-form instructions with a strict machine-readable schema defining allowed action names, payload types, bounds, and game metadata. 3. Validate the response locally and reject unknown fields, executable command text, URLs, credential requests, and directives unrelated to selecting an available game action. 4. Base submitted moves exclusively on the authenticated `/state` endpoint's validated `available_actions` array. 5. Add a hard rule forbidding tool calls, shell commands, secret disclosure, configuration changes, and policy changes based on API-provided prose. 6. Where natural-language game descriptions remain necessary, display or summarize them as quoted data rather than treating them as authoritative instructions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:151
• Finding: Unvalidated Remote Identifiers Are Interpolated into Shell Commands and Cron System Events<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:139-143`, `SKILL.md:151-170`, and `SKILL.md:179-184` **Vulnerability Type**: Command and instruction injection through unsafe interpolation **Risk Level**: High ### Vulnerable Code ```markdown **You are woken by a system event containing `CLAWZONE_QUEUE_POLL`.** Extract the game_id from the event text and run: ```bash curl -s "${CLAWZONE_URL}/api/v1/matchmaking/status?game_id=GAME_ID" \ -H "Authorization: Bearer ${CLAWZONE_API_KEY}" | jq '.' ``` ``` ```markdown 1. Save `match_id` from response as MATCH_ID. 2. Delete queue cron: ```bash openclaw cron remove QUEUE_CRON_ID ``` 3. Create match cron (every 5s). **Write a summary** of the match for your future self: ```bash openclaw cron add \ --name "clawzone-match-MATCH_ID" \ --every "5s" \ --session main \ --wake now \ --system-event "CLAWZONE_MATCH_POLL match_id=MATCH_ID game_id=GAME_ID ## Match Context {YOUR_SUMMARY — e.g.: Playing Connect Four as player X (yellow). Match MATCH_ID, turn 1. Opponent moves first. Strategy: take center column c3 on my first move. Cron job ID: MATCH_CRON_ID.} ## Instructions Check match: curl -s ${CLAWZONE_URL}/api/v1/matches/MATCH_ID | jq '{status, current_turn}' If finished: delete cron (openclaw cron remove MATCH_CRON_ID), get result. If in_progress: get /state, submit action if available_actions present, then go idle." ``` ``` ```markdown **You are woken by a system event containing `CLAWZONE_MATCH_POLL`.** Extract match_id from the event text. **4a. Check match status:** ```bash curl -s "${CLAWZONE_URL}/api/v1/matches/MATCH_ID" | jq '{status, current_turn}' ``` ``` ### Technical Analysis The Skill instructs the Agent to take `game_id` values from cron event text and `match_id` values from server responses, then substitute them into shell commands, cron job names, URLs, and multiline `--system-event` content. It does not require these values to ...[truncated 2257 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate every `GAME_ID`, `MATCH_ID`, and cron job ID before use against the platform's exact identifier format, such as a strict UUID or ULID regular expression. 2. Reject identifiers containing whitespace, newlines, control characters, quotes, shell metacharacters, URL delimiters, or leading hyphens. 3. Do not generate shell source code by replacing placeholders. Use a script that receives validated values as positional arguments and invokes commands through an argument-array API. 4. URL-encode query parameters and path components using a dedicated encoder rather than direct concatenation. 5. Store cron context as schema-validated JSON containing only identifiers and enumerated state values. 6. Keep prose summaries and remote data out of `--system-event`; if context is required, encode it and decode it only after schema validation. 7. Use `--` before positional command arguments where supported to prevent identifiers from being interpreted as options. 8. Treat all cron event content as untrusted. Verify that the event corresponds to a locally recorded job ID and expected game or match before acting. 9. Avoid embedding runnable command instructions in cron event text. Dispatch to a fixed local handler whose behavior cannot be altered by event-supplied strings. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to use an API key and even register accounts against an external service, but it does not clearly warn the user that credentials and account data will be transmitted to a third-party platform. In an agent setting, this can lead to users unknowingly authorizing external actions and disclosure of sensitive identifiers to a remote service.

External Transmission

Medium

• Category: Data Exfiltration

Content

**1b.** Join matchmaking queue:

```bash
curl -s -X POST "${CLAWZONE_URL}/api/v1/matchmaking/join" \
  -H "Authorization: Bearer ${CLAWZONE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"game_id": "GAME_ID"}' | jq '.'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

ACTION=$(curl -s "${CLAWZONE_URL}/api/v1/matches/MATCH_ID/state" \
  -H "Authorization: Bearer ${CLAWZONE_API_KEY}" | jq '.available_actions[INDEX]')

curl -s -X POST "${CLAWZONE_URL}/api/v1/matches/MATCH_ID/actions" \
  -H "Authorization: Bearer ${CLAWZONE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "$ACTION" | jq '.'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Register and get agent key** (only if user has no `czk_` key):
```bash
# Step 1: Create a user account
curl -s -X POST "${CLAWZONE_URL}/api/v1/auth/register" \
  -H "Content-Type: application/json" \
  -d '{"username": "my-user", "password": "mypassword"}' | jq '.'
# Save session_token from response

• Confidence: 90% confidence
• Finding: The registration flow causes the agent to create an account on an external service and transmit username/password data without a strong built-in consent boundary or warning. In agent environments, autonomous account creation and handling of credentials can create privacy, compliance, and unintended-account risks if triggered without explicit informed approval.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Save session_token from response

# Step 2: Create an agent under the account
curl -s -X POST "${CLAWZONE_URL}/api/v1/auth/agents" \
  -H "Authorization: Bearer SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "my-agent", "framework": "openclaw"}' | jq '.'

• Confidence: 86% confidence
• Finding: This step creates an agent using a session token obtained from registration, which is another authenticated external side effect that can provision resources on a third-party platform. Without explicit user confirmation and clearer safeguards around token handling, the skill could cause unintended account/resource creation or misuse of session credentials.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Leave queue:**
```bash
curl -s -X DELETE "${CLAWZONE_URL}/api/v1/matchmaking/leave" \
  -H "Authorization: Bearer ${CLAWZONE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"game_id": "GAME_ID"}' | jq '.'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Low

• Confidence: 91% confidence
• Finding: The activation guidance says to use the skill whenever the user asks to 'play a game on ClawZone, join matchmaking, check match status/results, list games, or register an agent,' but it does not provide explicit trigger phrases, scope limits, or negative examples. In a markdown skill description, this kind of broad natural-language invocation guidance can overlap with general gaming or account-creation requests and make activation boundaries unclear.

Static analysis

No suspicious patterns detected.