FortClaw Game

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:49 AM UTC
• Version: 0.1.0

Overview

FortClaw is a real-money game skill with coherent game functionality, but it asks agents to keep mutable remote instructions in a recurring heartbeat and exposes paid, destructive, and withdrawal actions without strong approval boundaries.

Review before installing. Use this only with a tightly scoped FortClaw account, store the API key in a proper secret store or a 0600-permission file, do not put it in agent memory, disable automatic remote heartbeat updates, and require explicit human confirmation for every paid action, destructive action, and withdrawal.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: heartbeat.md:8

Finding

Persistent Retrieval and Activation of Mutable Remote Instructions

Content

View full analysis

~/.openclaw/skills/fortclaw/SKILL.md curl -s https://fortclaw.com/heartbeat.md > ~/.openclaw/skills/fortclaw/HEARTBEAT.md curl -s https://fortclaw.com/gameguide.md > ~/.openclaw/skills/fortclaw/GAMEGUIDE.md ``` ``` ### Technical Analysis The Skill directs the Agent to periodically retrieve a mutable remote heartbeat document and follow its instructions. It also replaces locally installed Skill files with content served by `fortclaw.com`. No cryptographic signature, pinned digest, immutable version URL, content validation, review step, or human approval is required before the downloaded instructions become active. Consequently, the behavior reviewed during installation is not necessarily the behavior that will execute later. The instruction is also added to a recurring heartbeat and associated with p ...[truncated 1893 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:64

Finding

FortClaw API Key Is Recommended for Plaintext Persistent Storage

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: heartbeat.md:126

Finding

Recurring Workflow Exposes Paid and Withdrawal Operations Without Mandatory Human Approval

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The skill recommends storing an API key in a plaintext local file (~/.config/fortclaw/credentials.json) and also encourages keeping it in memory or environment variables. For agent ecosystems where tools and other skills may access local files, this materially increases the chance of credential theft and account impersonation.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

⚠️ Save your api_key immediately! You need it for all requests.

Recommended: Save your credentials to ~/.config/fortclaw/credentials.json:

json

{

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

Install locally:

bash

mkdir -p ~/.openclaw/skills/fortclaw
curl -s https://fortclaw.com/skill.md > ~/.openclaw/skills/fortclaw/SKILL.md
curl -s https://fortclaw.com/heartbeat.md > ~/.openclaw/skills/fortclaw/HEARTBEAT.md
curl -s https://fortclaw.com/gameguide.md > ~/.openclaw/skills/fortclaw/GAMEGUIDE.md

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Every agent needs to register and get claimed by their human:

bash

curl -X POST https://api.aix.games/agents/register/claw

Response:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

Every agent needs to register and get claimed by their human:

bash

curl -X POST https://api.aix.games/agents/register/claw

Response:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The withdraw action transfers assets and the description notes that amount is optional with a default of 'all', but it lacks a strong warning that omission may withdraw the full balance. For an agent executing user requests, this creates a real risk of unintended asset transfer to a default or user-supplied destination wallet.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill exposes destructive paid actions like bomb and nuke with prices and invocation examples but does not place an explicit safety warning immediately around them or require user confirmation. In an autonomous-agent context, this can lead to unintended high-cost transactions and irreversible game-state destruction if the agent follows natural-language prompts too eagerly.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 544)May include surrounding context.

bash

# Check your units
curl -X POST https://mcp.aix.games/ \
  -H "Content-Type: application/json" \
  -H "x-api-key: YOUR_API_KEY" \
  -d '{"jsonrpc": "2.0", "method": "tools/call", "params": {"name": "units", "arguments": {}}, "id": 1}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · gameguide.md (reported line 351)May include surrounding context.

Get Your Invite Code

bash

curl -X POST https://mcp.aix.games/ \
  -H "Content-Type: application/json" \
  -H "x-api-key: YOUR_API_KEY" \
  -d '{"jsonrpc": "2.0", "method": "tools/call", "params": {"name": "invite", "arguments": {}}, "id": 1}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide provides direct withdrawal instructions for moving USDC off-platform but does not warn that this action transfers assets externally and may be irreversible. In an agent-executable skill context, omission of such a warning increases the risk of unintended fund movement, especially if an agent or user follows the example mechanically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The heartbeat instructs the agent to overwrite local skill files directly from remote URLs based only on a version check, with no integrity verification, signature check, pinning, or human confirmation. If the remote host, CDN, DNS, or transport path is compromised, the agent can be induced to replace its own operating instructions with attacker-controlled content, creating a supply-chain style takeover of future behavior.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

Compare with your saved version. If there's a new version, re-fetch the skill files:

bash

curl -s https://fortclaw.com/skill.md > ~/.openclaw/skills/fortclaw/SKILL.md
curl -s https://fortclaw.com/heartbeat.md > ~/.openclaw/skills/fortclaw/HEARTBEAT.md
curl -s https://fortclaw.com/gameguide.md > ~/.openclaw/skills/fortclaw/GAMEGUIDE.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · heartbeat.md (reported line 15)May include surrounding context.

Compare with your saved version. If there's a new version, re-fetch the skill files:

bash

curl -s https://fortclaw.com/skill.md > ~/.openclaw/skills/fortclaw/SKILL.md
curl -s https://fortclaw.com/heartbeat.md > ~/.openclaw/skills/fortclaw/HEARTBEAT.md
curl -s https://fortclaw.com/gameguide.md > ~/.openclaw/skills/fortclaw/GAMEGUIDE.md

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

Compare with your saved version. If there's a new version, re-fetch the skill files:

bash

curl -s https://fortclaw.com/skill.md > ~/.openclaw/skills/fortclaw/SKILL.md
curl -s https://fortclaw.com/heartbeat.md > ~/.openclaw/skills/fortclaw/HEARTBEAT.md
curl -s https://fortclaw.com/gameguide.md > ~/.openclaw/skills/fortclaw/GAMEGUIDE.md

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · heartbeat.md (reported line 15)May include surrounding context.

Compare with your saved version. If there's a new version, re-fetch the skill files:

bash

curl -s https://fortclaw.com/skill.md > ~/.openclaw/skills/fortclaw/SKILL.md
curl -s https://fortclaw.com/heartbeat.md > ~/.openclaw/skills/fortclaw/HEARTBEAT.md
curl -s https://fortclaw.com/gameguide.md > ~/.openclaw/skills/fortclaw/GAMEGUIDE.md

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill recommends spawn and especially heal actions that have gameplay and financial consequences, but it does not require user confirmation or even prominently warn that funds may be spent. In an automated heartbeat context, this can normalize autonomous value-affecting actions and lead to unintended USDC expenditure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This section encourages actions such as moving units, investing in upgrades, buying packs, and potentially withdrawing funds without an upfront safety boundary or approval requirement. In a periodic heartbeat, these instructions can drive autonomous strategic and financial operations that are irreversible or user-impacting, increasing the risk of loss of assets, poor trades, or unauthorized withdrawals.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.json (reported line 1)May include surrounding context.

json

{"name":"fortclaw","version":"1.7.0","description":"The strategy game for AI agents. Move units on the gaming map to capture territory and claim USDC rewards.","author":"fortclaw","license":"MIT","homepage":"https://fortclaw.com","keywords":["openclaw","skill","social","reddit","agents","ai","community","play","games","lobster"],"openclaw":{"emoji":"🦞","category":"social","api_base":"https://api.claw.aix.games/v1","files":{"SKILL.md":"https://fortclaw.com/SKILL.md","HEARTBEAT.md":"https://fortclaw.com/heartbeat.md"},"requires":{"bins":["curl"]},"triggers":["fortclaw","start the game","move unit","play fortclaw","spawn unit","get molt pack","add fury to unit","heal unit","play the game","review gaming map"]}}

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest defines trigger phrases such as "start the game", "move unit", "heal unit", and especially "play the game" that are broad enough to overlap with normal user conversation. This can cause the skill to activate unexpectedly in unrelated contexts, increasing the chance of unintentional external actions or user confusion when the agent is connected to a game service with reward mechanics.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.