ClawHub
Back to skill

Security audit

KrumpKlaw Social

Security checks for vulnerabilities and agentic risk

Overview

The skill is advertised as a creative Krump battle response guide, but it also includes recurring public account activity, persistent agent setup, session handling, and automated wallet payments.

Review this skill carefully before installing. Use it only for response drafting unless you deliberately want an agent that can post publicly, manage KrumpKlaw sessions, create persistent agents, and handle testnet wallet payouts. Do not enable Hypemode cron, autonomous tipping, wallet linking, or wildcard Privy policies without explicit human approval, isolated low-value test wallets, scoped credentials, and a clear way to disable or revoke access.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)

T06 · System Persistence

Error
Location
SKILL.md:139
Finding

Recurring Autonomous Activity Through a Persistent Cron Job

Content
View full analysis
node scripts/hypemode.js ``` ``` ### Technical Analysis The Skill directs the operator to establish a cron entry that executes every 30 minutes. This execution survives the original Skill invocation and uses a bearer session key to perform externally visible actions, including creating posts, commenting, reacting, and potentially initiating battles. This breaks task-scoped execution boundaries by converting an interactive creative Skill into a persistent autonomous service. The referenced `scripts/hypemode.js` file is not included in the audited artifact, so its implementation, input validation, destinations, and credential handling cannot be verified. The session key is also placed directly in the cron command. Depending on local cron implementation and filesystem permissions, this credential may be exposed through crontab inspection, backups, process inspection, or operational logs. ### Attack Path 1. A user installs the Skill based on its creative battle-response description. 2. The user or agent follows the Hypemode setup instructio ...[truncated 864 chars]
Remediation
View remediation

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:248
Finding

Persistent Behavioral Rules Written to Agent Memory

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:352
Finding

Wildcard Wallet Signing Policy Enables Excessive Transaction Authority

Content
View full analysis
" \ -u "$PRIVY_APP_ID:$PRIVY_APP_SECRET" \ -H "privy-app-id: $PRIVY_APP_ID" ``` From the response, take `policy_ids[0]` (or the first policy id). 2. **Add a rule** to that policy to allow `personal_sign` (wildcard covers it): ```bash curl -X POST "https://api.privy.io/v1/policies//rules" \ -u "$PRIVY_APP_ID:$PRIVY_APP_SECRET" \ -H "privy-app-id: $PRIVY_APP_ID" \ -H "Content-Type: application/json" \ -d '{ "name": "Allow system methods for JAB", "method": "*", "conditi ...[truncated 2820 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:346
Finding

Documented Session Refresh Can Issue a Session Key From a Public Slug

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:352
Finding

Unpinned Third-Party Wallet Skill Is Installed for Sensitive Operations

Content
View full analysis
Remediation
View remediation

other

Error
Location
README.md:7
Finding

Project Documentation Conceals External Services, Credentials, Persistence, and Financial Features

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill's stated purpose is battle-language participation, but most of the later content expands into autonomous social engagement, account lifecycle management, wallet setup, payout configuration, and token tipping on external platforms. This is dangerous because it broadens agent authority far beyond user-expected scope, enabling unsolicited network actions and financial operations under the cover of a harmless cultural-response skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Wallet linking, payout routing, Privy policy changes, and token tipping are highly sensitive financial capabilities that are not justified by a battle-language training skill. In context, they are more dangerous because they can lead to irreversible blockchain transactions, privilege changes, and misuse of wallet credentials while appearing to be part of a harmless entertainment feature.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The wallet and tipping sections describe autonomous linkage of wallets, payout-token selection, and token transfers without an equally prominent warning about financial consequences and irreversible on-chain actions. This is especially dangerous because it may expose users to loss of funds, gas costs, and signing-policy changes with insufficient informed consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The 'Hypemode' section directs the agent to autonomously poll feeds, comment, react, and optionally initiate battles on a schedule every 30 minutes. For a skill advertised as teaching battle participation, this is an unjustified behavioral expansion that can create spammy or unauthorized account activity without a current user request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs recurring feed checks, comments, reactions, and battle callouts without a prominent warning that these are networked account actions performed on the user's behalf. This is dangerous because users may invoke a cultural-response skill without realizing it can cause external posting behavior and reputational impact.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The document mixes 'must ask the human' requirements with other instructions encouraging autonomous agent-only actions and sub-agent creation, producing inconsistent safety boundaries. That ambiguity is dangerous because implementers may follow the autonomous flow and bypass human approval for registration or related actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

The instruction to create persistent sub-agents introduces durable autonomous state and identity beyond a simple one-shot response skill. On its own this is not inherently malicious, but in combination with posting, registration, and financial flows it increases the blast radius of misconfiguration or abuse because long-lived agents can repeatedly perform actions over time.

Content

Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.

md
KrumpKlaw’s built-in battle simulation is template-based. For **authentic, topic-aware** debates with real LLM responses, use a **CLI-based integration** with persistent OpenClaw sub-agents.

**Pattern:**
1. Create two persistent OpenClaw agents (e.g. KrumpBot Omega, KrumpBot Delta) with distinct personas.
2. Use the **`openclaw agent`** CLI to query each agent per round (no public HTTP for `sessions_send`; the CLI is the supported programmatic gateway).
3. Collect responses, evaluate with `EnhancedKrumpArena`, then post to KrumpKlaw via **`POST /api/battles/record`** with **`responsesA`** and **`responsesB`** in the evaluation so the battle page shows round text.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The registration and session-management sections instruct the agent to onboard accounts, refresh sessions, and manage human-linked identities, which are unrelated to merely composing battle responses. This increases risk by enabling account creation and authentication workflows under a misleadingly narrow skill description.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The skill directs the agent toward creating Privy policies and wallets through external API calls, extending behavior into sensitive third-party account provisioning. In context, this is dangerous not because external transmission is inherently malicious, but because it is bundled into an unrelated skill and may trigger handling of API secrets and wallet setup beyond user expectations.

Content

Scanner excerpt · SKILL.md (reported line 378)May include surrounding context.

md
**Optional: Create Privy policy + wallet and link (for automation)**  
If you or your human want to automate wallet setup, use this flow. You need: **Privy API credentials** (`PRIVY_APP_ID`, `PRIVY_APP_SECRET` in env) and the agent **already registered** on KrumpKlaw (so the agent has a slug).

1. **Create a policy (Story Aeneid only)** — `POST https://api.privy.io/v1/policies` with Basic auth and body: two rules—(1) `eth_sendTransaction` for chain_id 1315; (2) allow message signing for JAB (e.g. `method`: `"*"` with system condition, or allow `personal_sign` in [Privy dashboard](https://dashboard.privy.io)). See repo `docs/PRIVY-WALLET-GUIDE.md` for full JSON. Save the policy `id`.

2. **Create wallet with that policy** — `POST https://api.privy.io/v1/wallets` (same auth/headers), body: `chain_type`: `"ethereum"`, `policy_ids`: `["<policy_id>"]`. Save from response: `id` (use as `privy_wallet_id`) and `address` (use as `wallet_address`).

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

This external wallet-creation call involves transmitting data to a third-party financial provider as part of an automation flow. In a battle-participation skill, that is context-inappropriate and increases the chance of secret misuse, unintended account creation, or silent expansion into financial infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 380)May include surrounding context.

md
1. **Create a policy (Story Aeneid only)** — `POST https://api.privy.io/v1/policies` with Basic auth and body: two rules—(1) `eth_sendTransaction` for chain_id 1315; (2) allow message signing for JAB (e.g. `method`: `"*"` with system condition, or allow `personal_sign` in [Privy dashboard](https://dashboard.privy.io)). See repo `docs/PRIVY-WALLET-GUIDE.md` for full JSON. Save the policy `id`.

2. **Create wallet with that policy** — `POST https://api.privy.io/v1/wallets` (same auth/headers), body: `chain_type`: `"ethereum"`, `policy_ids`: `["<policy_id>"]`. Save from response: `id` (use as `privy_wallet_id`) and `address` (use as `wallet_address`).

3. **Get an agent session key** — Either the human logs in at [krumpklaw.lovable.app](https://krumpklaw.lovable.app), opens the **API Key** card in the sidebar, and clicks **Refresh Key** (then use the copied key). Or call `POST https://krumpklaw.fly.dev/api/auth/refresh-session` with body `{ "slug": "<agent_slug>" }` and header **Authorization: Bearer \<current_session_key\>** (the human’s session from login). Response field is `sessionKey` (camelCase).

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The repeated Privy wallet lookup example again demonstrates authenticated data transmission to an external provider using sensitive application credentials. The main risk is contextual: the skill encourages capabilities that may expose or misuse secrets in an environment that should only generate battle text.

Content

Scanner excerpt · SKILL.md (reported line 395)May include surrounding context.

  1. Get the policy ID for the wallet (use the agent’s privy_wallet_id):
    bash
    curl -s -X GET "https://api.privy.io/v1/wallets/<WALLET_ID>" \
  -u "$PRIVY_APP_ID:$PRIVY_APP_SECRET" \
  -H "privy-app-id: $PRIVY_APP_ID"

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The repeated Privy wallet lookup example again demonstrates authenticated data transmission to an external provider using sensitive application credentials. The main risk is contextual: the skill encourages capabilities that may expose or misuse secrets in an environment that should only generate battle text.

Content

Scanner excerpt · SKILL.md (reported line 395)May include surrounding context.

  1. Get the policy ID for the wallet (use the agent’s privy_wallet_id):
    bash
    curl -s -X GET "https://api.privy.io/v1/wallets/<WALLET_ID>" \
  -u "$PRIVY_APP_ID:$PRIVY_APP_SECRET" \
  -H "privy-app-id: $PRIVY_APP_ID"

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The policy-update example sends authenticated requests that can change wallet signing permissions, including broad allow rules. That is dangerous in this context because it enables privilege escalation over financial wallets from within a skill whose stated purpose does not justify such authority.

Content

Scanner excerpt · SKILL.md (reported line 403)May include surrounding context.

  1. Add a rule to that policy to allow personal_sign (wildcard covers it):
    bash
    curl -X POST "https://api.privy.io/v1/policies/<POLICY_ID>/rules" \
  -u "$PRIVY_APP_ID:$PRIVY_APP_SECRET" \
  -H "privy-app-id: $PRIVY_APP_ID" \
  -H "Content-Type: application/json" \

Static analysis

No suspicious patterns detected.