Security audit

GameClaw

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for installing GameClaw games, but it includes review-worthy steps that can change system-wide network settings and install executables from an untrusted mirror.

Install only if you are comfortable reviewing each download source and refusing the mirror fallback unless you can verify the binary independently. Do not allow the hosts-file repair unless you understand the system-wide DNS effect, have reviewed the exact changes, and know how to restore the backup afterward.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:119
Finding: Mirror-supplied executable is authenticated with a checksum from the same archive
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 119–134 and 286–294
Vulnerability Type: Untrusted executable download with non-independent integrity verification
Risk Level: High

Complete Code Snippet

bash
EXPECTED=$(awk '{print $1}' "$TMP/$GAME-$PLATFORM/SHA256SUMS") ACTUAL=$(shasum -a 256 "$TMP/$GAME-$PLATFORM/$GAME" | awk '{print $1}') [ "$EXPECTED" = "$ACTUAL" ] || { echo "CHECKSUM MISMATCH"; exit 1; }

bash
install -m 755 "$TMP/$GAME-$PLATFORM/$GAME" "$BIN/$GAME.new" [ -f "$BIN/$GAME" ] && mv "$BIN/$GAME" "$BIN/$GAME.previous" mv "$BIN/$GAME.new" "$BIN/$GAME" rm -rf "$TMP" "$BIN/$GAME" --version

bash
curl -fL -o "$TMP/$ASSET" \ "https://ghfast.top/https://github.com/Arcobalneo/gameclaw/releases/download/<tag>/$ASSET"

text
Only use a mirror with the player's explicit approval. Mirrors are untrusted: verify `SHA256SUMS` and say that the download came from a mirror. If no checksum is available, report that instead of pretending it is verified.

Technical Analysis

The fallback workflow downloads a release archive through a third-party mirror. The archive contains both the executable and the SHA256SUMS file used to authenticate that executable.

This verification establishes only that the binary matches the checksum bundled alongside it. It does not establish that either file originated from the GameClaw maintainer. A mirror serving modified content can supply an altered executable and a corresponding checksum, causing the comparison to succeed.

The verified file is subsequently installed with executable permissions and invoked with --version. Player approval to use the mirror acknowledges its use but does not provide an independent authenticity guarantee.

Attack Path

A normal GitHub release download fails.

The player approves the documented mirror fallback.

The mirror serves an archive containing a modified game executable.

The same archive contains a SHA256SUMS entry ma ...[truncated 816 chars]
Remediation: View remediation
Remediation Suggestions

Obtain expected hashes from a channel independent of the archive and mirror, such as authenticated release metadata fetched directly from the authoritative repository.

Prefer cryptographic signatures created by a trusted maintainer key and verify them before installation.

Pin downloads to a specific release tag rather than resolving mutable “latest” content when reproducibility is required.

Treat a checksum bundled inside the downloaded archive only as corruption detection, not as authenticity verification.

If independently authenticated hashes or signatures cannot be retrieved, refuse to install or execute a mirror-supplied binary.

Perform verification before assigning executable permissions or moving the file into the installation directory.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:236
Finding: Unvalidated third-party content is written into the system hosts file
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 236–266
Vulnerability Type: Unvalidated remote configuration applied with system privileges
Risk Level: Medium

Complete Code Snippet

bash
HOSTS=/etc/hosts sudo cp "$HOSTS" "$HOSTS.gameclaw.bak.$(date +%s)" curl -fsSL https://raw.hellogithub.com/hosts -o /tmp/github520.hosts sudo sed -i.bak '/^# GitHub520 Host Start$/,/^# GitHub520 Host End$/d' "$HOSTS" sudo tee -a "$HOSTS" < /tmp/github520.hosts > /dev/null sudo dscacheutil -flushcache 2>/dev/null || true # macOS sudo killall -HUP mDNSResponder 2>/dev/null || true sudo resolvectl flush-caches 2>/dev/null || true # Linux

powershell
$hosts = Join-Path $env:SystemRoot 'System32\drivers\etc\hosts' Copy-Item $hosts "$hosts.gameclaw.bak" -Force $raw = (Invoke-WebRequest https://raw.hellogithub.com/hosts -UseBasicParsing).Content $current = Get-Content $hosts -Raw $current = [regex]::Replace($current, '(?s)# GitHub520 Host Start.*?# GitHub520 Host End\r?\n?', '') Set-Content -Path $hosts -Value ($current.TrimEnd() + "`r`n" + $raw) -Encoding ASCII ipconfig /flushdns

Technical Analysis

The troubleshooting procedure downloads an entire hosts-file block from a third-party endpoint and writes that content into the privileged operating-system hosts file. The instructions do not parse the response, restrict it to required GitHub hostnames, validate address and hostname syntax, or present the exact entries for approval.

The skill does require explicit player approval and creates a backup before the modification. These controls support recovery and informed consent, but they do not constrain the remote content ultimately granted authority over system-wide hostname resolution.

If the remote endpoint serves altered content, it can introduce entries for domains unrelated to GameClaw or GitHub. Those entries take precedence over normal DNS resolution on many systems.

Attack Path

A GitHub download fails and the player ...[truncated 1173 chars]
Remediation: View remediation
Remediation Suggestions

Parse the downloaded content before applying it and allow only the specific GitHub domains required for release downloads.

Reject malformed addresses, wildcard-like entries, comments outside the expected block, duplicate directives, and unrelated hostnames.

Display the exact validated diff and obtain approval for that specific set of changes.

Authenticate the content with a pinned signature or independently obtained digest.

Prefer a narrowly scoped proxy or resolver configuration that affects only the download process instead of changing system-wide name resolution.

Preserve the existing backup and provide a tested rollback command.

Download into a securely created temporary file and delete it after the validated update completes.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.
md
- To update every installed game, loop the catalog in step 1 and repeat. - To roll back: `mv "$BIN/$GAME.previous" "$BIN/$GAME"`. ### Update this skill itself Ask the player to run `clawhub update @arcobalneo/gameclaw` in their harness. Do not rewrite the installed skill files yourself. If ClawHub is unreachable, tell

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.
md
the player that a newer `SKILL.md` exists in the repo and let them decide whether

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill sets a consent boundary that says not to run sudo on the agent's own initiative, but later embeds a privileged remediation flow that edits /etc/hosts with sudo. That contradiction can cause an agent to perform sensitive system changes under the cover of 'troubleshooting,' increasing the chance of unauthorized privilege use and risky network trust modifications.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 96% confidence
Finding: The skill instructs use of sudo to back up and modify /etc/hosts as part of download troubleshooting. Editing the hosts file with elevated privileges changes system-wide name resolution and can redirect trusted domains, so embedding these commands in an agent skill creates a meaningful risk of harmful privileged actions if followed automatically or with insufficient scrutiny.
Content: Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.
bash
HOSTS=/etc/hosts sudo cp "$HOSTS" "$HOSTS.gameclaw.bak.$(date +%s)" curl -fsSL https://raw.hellogithub.com/hosts -o /tmp/github520.hosts sudo sed -i.bak '/^# GitHub520 Host Start$/,/^# GitHub520 Host End$/d' "$HOSTS"

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 96% confidence
Finding: This privileged sed command removes and rewrites a block in /etc/hosts, which is a sensitive system configuration file. If executed by an agent or copied without understanding, it can disrupt networking or insert untrusted DNS overrides for GitHub-related domains across the whole machine.
Content: Scanner excerpt · SKILL.md (reported line 249)May include surrounding context.
md
sudo cp "$HOSTS" "$HOSTS.gameclaw.bak.$(date +%s)" curl -fsSL https://raw.hellogithub.com/hosts -o /tmp/github520.hosts sudo sed -i.bak '/^# GitHub520 Host Start$/,/^# GitHub520 Host End$/d' "$HOSTS" sudo tee -a "$HOSTS" < /tmp/github520.hosts > /dev/null sudo dscacheutil -flushcache 2>/dev/null || true # macOS

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 95% confidence
Finding: Appending externally fetched content into /etc/hosts with sudo chains network-delivered data directly into a privileged system file. Even though the source is described as maintained, this creates a trust-on-first-use problem and could enable malicious or stale domain mappings to affect all future connections.
Content: Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.
md
curl -fsSL https://raw.hellogithub.com/hosts -o /tmp/github520.hosts sudo sed -i.bak '/^# GitHub520 Host Start$/,/^# GitHub520 Host End$/d' "$HOSTS" sudo tee -a "$HOSTS" < /tmp/github520.hosts > /dev/null sudo dscacheutil -flushcache 2>/dev/null || true # macOS sudo killall -HUP mDNSResponder 2>/dev/null || true

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.
sudo sed -i.bak '/^# GitHub520 Host Start$/,/^# GitHub520 Host End$/d' "$HOSTS" sudo tee -a "$HOSTS" < /tmp/github520.hosts > /dev/null

sudo dscacheutil -flushcache 2>/dev/null || true # macOS sudo killall -HUP mDNSResponder 2>/dev/null || true sudo resolvectl flush-caches 2>/dev/null || true # Linux

text

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.
sudo sed -i.bak '/^# GitHub520 Host Start$/,/^# GitHub520 Host End$/d' "$HOSTS" sudo tee -a "$HOSTS" < /tmp/github520.hosts > /dev/null

sudo dscacheutil -flushcache 2>/dev/null || true # macOS sudo killall -HUP mDNSResponder 2>/dev/null || true sudo resolvectl flush-caches 2>/dev/null || true # Linux

text

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.
sudo sed -i.bak '/^# GitHub520 Host Start$/,/^# GitHub520 Host End$/d' "$HOSTS" sudo tee -a "$HOSTS" < /tmp/github520.hosts > /dev/null

sudo dscacheutil -flushcache 2>/dev/null || true # macOS sudo killall -HUP mDNSResponder 2>/dev/null || true sudo resolvectl flush-caches 2>/dev/null || true # Linux

text

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation states that gameplay itself is out of scope for this skill, limiting the skill to catalog/install/update/troubleshooting responsibilities. However, the later 'Launch and play (minimal)' section provides direct gameplay command sequences such as 'new', 'actions', 'act', and 'recap', which contradicts the declared scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Complete Code Snippet

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Complete Code Snippet

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Self-Modification

Ae1

Intent-Code Divergence

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Intent-Code Divergence

Static analysis