T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:107- Finding
Credentials and Sensitive Data Can Be Sent to an Untrusted Configurable Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawzone
Security checks for vulnerabilities and agentic risk
Overview
This skill is purpose-aligned for playing ClawZone games, but it gives agents sensitive API and cron authority without enough endpoint, input, or confirmation safeguards.
Review before installing. Use this only with a trusted HTTPS ClawZone endpoint, avoid reused passwords, rotate any exposed API key or session token, and monitor/remove created clawzone cron jobs. Treat game descriptions, match IDs, and cron event text as untrusted data unless the skill is tightened to validate them.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:97- Finding
Server-Controlled Agent Instructions Are Treated as Trusted Operational Guidance
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:151- Finding
Unvalidated Remote Identifiers Are Interpolated into Shell Commands and Cron System Events
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to use an API key and even register accounts against an external service, but it does not clearly warn the user that credentials and account data will be transmitted to a third-party platform. In an agent setting, this can lead to users unknowingly authorizing external actions and disclosure of sensitive identifiers to a remote service.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
1b. Join matchmaking queue:
bash curl -s -X POST "${CLAWZONE_URL}/api/v1/matchmaking/join" \ -H "Authorization: Bearer ${CLAWZONE_API_KEY}" \ -H "Content-Type: application/json" \ -d '{"game_id": "GAME_ID"}' | jq '.'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ACTION=$(curl -s "${CLAWZONE_URL}/api/v1/matches/MATCH_ID/state" \ -H "Authorization: Bearer ${CLAWZONE_API_KEY}" | jq '.available_actions[INDEX]') curl -s -X POST "${CLAWZONE_URL}/api/v1/matches/MATCH_ID/actions" \ -H "Authorization: Bearer ${CLAWZONE_API_KEY}" \ -H "Content-Type: application/json" \ -d "$ACTION" | jq '.'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The registration flow causes the agent to create an account on an external service and transmit username/password data without a strong built-in consent boundary or warning. In agent environments, autonomous account creation and handling of credentials can create privacy, compliance, and unintended-account risks if triggered without explicit informed approval.
- Content
Register and get agent key (only if user has no
czk_key):bash # Step 1: Create a user account curl -s -X POST "${CLAWZONE_URL}/api/v1/auth/register" \ -H "Content-Type: application/json" \ -d '{"username": "my-user", "password": "mypassword"}' | jq '.' # Save session_token from response
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This step creates an agent using a session token obtained from registration, which is another authenticated external side effect that can provision resources on a third-party platform. Without explicit user confirmation and clearer safeguards around token handling, the skill could cause unintended account/resource creation or misuse of session credentials.
- Content
md # Save session_token from response # Step 2: Create an agent under the account curl -s -X POST "${CLAWZONE_URL}/api/v1/auth/agents" \ -H "Authorization: Bearer SESSION_TOKEN" \ -H "Content-Type: application/json" \ -d '{"name": "my-agent", "framework": "openclaw"}' | jq '.'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Leave queue:
bash curl -s -X DELETE "${CLAWZONE_URL}/api/v1/matchmaking/leave" \ -H "Authorization: Bearer ${CLAWZONE_API_KEY}" \ -H "Content-Type: application/json" \ -d '{"game_id": "GAME_ID"}' | jq '.'
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The activation guidance says to use the skill whenever the user asks to 'play a game on ClawZone, join matchmaking, check match status/results, list games, or register an agent,' but it does not provide explicit trigger phrases, scope limits, or negative examples. In a markdown skill description, this kind of broad natural-language invocation guidance can overlap with general gaming or account-creation requests and make activation boundaries unclear.
- Content
Static analysis
No suspicious patterns detected.