ClawHub
Back to skill

Security audit

Godot VR

Security checks for vulnerabilities and agentic risk

Overview

ClawScan marks this Godot VR skill suspicious because scanners report project-file overwrite and machine-wide runtime risks; the review is incomplete because three referenced paths were unresolved.

Consider the reported risk of losing project content during an overwrite and the possibility that changing the OpenXR default could affect other XR applications. Skillspector inspected all five listed components, but its analysis was partial because three local references could not be resolved, so the evidence does not cover those paths.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/godot-47-api.md (reported line 62)May include surrounding context.

md
## Spatial shaders (procedural materials, 4.7)
Written against the 4.7 spatial-shader reference + compile errors that actually fired:
- **`shader_type spatial;` must be the first line of the code string.** If it is missing Godot renders the material as a no-op default white — **no error, no warning in the log**. The only reliable detector is a pixel sample (build a tiny rig that prints `get_viewport().get_texture().get_image().get_pixel(x, y)` for a known-albedo sphere).
- Fragment built-ins in 4.7: `VIEW` (NOT `V`), `NORMAL` (view-space), `VERTEX` (**view space** in the fragment stage — model+view already applied; **object space** only in the vertex stage). 4.7 has **NO `WORLD_MATRIX`** (`SHADER ERROR: Unknown identifier`) — `MODEL_MATRIX` is the model→world uniform, but it applies to *object-space* positions only. True world coords for noise, two verified forms (either makes the pattern sit still when the head moves — verified in-visor):
  - the documented recipe, in the fragment: `

The overwrite workaround instructs deletion of existing project files without warning about data loss.

Medium
Category
Output Handling
Confidence
91% confidence
Finding

The workaround explicitly instructs the agent to delete an existing project file before writing its replacement, without requiring a backup or validating that the replacement can be written. If writing fails or the operation is interrupted, user-authored scene or script content can be lost; the project-editing context makes this a concrete data-integrity risk rather than evidence of malicious intent.

Content

No source excerpt is available for this finding.

Runtime-switching instructions omit a warning that changing the machine-wide OpenXR default can affect other XR applications.

Medium
Category
Output Handling
Confidence
90% confidence
Finding

The workflow instructs changing the active runtime through its UI or directly through the registry, previously identified as an HKLM setting. It does not warn that this changes the default runtime beyond the current Godot project and may disrupt other XR applications.

Content

No source excerpt is available for this finding.