Security audit

clawCommunity

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a disclosed local game bridge, but it exposes unauthenticated local control and state APIs plus persistent interaction memory that users should review before installing.

Install only if you are comfortable running a local game bridge that can control an in-game character, send chat/dialogue, expose cached game state on localhost, and keep memory files across sessions. Close the bridge when not in use, avoid visiting untrusted websites while it runs, and review/delete the workspace/clawspace memory and log files if you do not want retained interaction history.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill manifest/documentation describes substantial runtime capabilities—process launching, networking, local bridge services, and file persistence—without declaring corresponding permissions or clearly constraining them. This undermines user and platform trust boundaries because the agent may exercise sensitive capabilities implicitly when invoked.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The stated purpose frames the skill as merely opening a social game space, but the documentation reveals a much broader control surface: bridge servers, command-and-control APIs, autonomous AI loops, persistent memory, and external service calls. This mismatch is security-relevant because users may authorize a seemingly simple skill without understanding that it can run services, control clients, and retain data long-term.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The documented autonomous decision loop materially expands behavior from a startup helper into a persistent agent that continues acting after launch. Persistent autonomy increases the chance of unintended actions, resource use, and user confusion because invocation no longer maps cleanly to a bounded task.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Combat-oriented autonomous behavior is outside the narrow stated purpose of a social virtual space and introduces extra agentic actions against dynamic entities in the environment. That scope expansion matters because it increases unpredictability and can trigger unwanted interactions or misuse of connected clients.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Persistent cross-session memory and consolidation are materially broader than a one-shot launcher/social connector and create durable data-retention risk. Storing interaction history, state, and summaries across sessions can expose sensitive behavioral data if users were not clearly informed or if files are accessed by other local processes/users.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The file starts an HTTP API on localhost:18766 that exposes health, client enumeration, perception/map data retrieval, and command-sending capabilities, which materially exceeds the manifest's described role of simply launching and connecting the game bridge. There is no authentication, authorization, or origin validation, so any local process—and in some environments a malicious webpage via the permissive CORS policy—can issue control requests or read cached game state.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The POST /command endpoint forwards arbitrary ai_control commands to connected game clients without any authentication or command allowlist. That gives any local actor with access to the port the ability to control gameplay actions, which is far broader than the stated purpose of opening a virtual social space and increases the risk of abuse, griefing, or unwanted automation.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The bridge stores and serves detailed perception data including self, position, robots, players, monsters, NPCs, map information, and transport nodes. That telemetry is more sensitive and expansive than needed for a simple 'open clawSpace' skill, and if accessed by unauthorized local code it could expose player activity, map layout, and other in-game state useful for surveillance or automation.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The HTTP endpoints /clients/:playerUid/perception and /clients/:playerUid/mapInfo expose cached perception and map data over an unauthenticated local API. Combined with Access-Control-Allow-Origin: *, this unnecessarily broadens access to sensitive in-game state beyond the skill's described function and may enable local data harvesting or browser-assisted access in some deployment setups.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The file defines an external HTTPS call to api.minimax.chat and reads MINIMAX_API_KEY from the environment, which expands the skill's trust boundary beyond the stated launch/bridge purpose. Even though callLLM is not invoked in this file, embedding dormant outbound AI capability creates an unnecessary exfiltration path for prompts or game-derived data and is not transparently disclosed to the user.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The manifest says this skill opens and connects a game space, but the code implements a persistent autonomous agent that polls local perception data and sends gameplay commands such as move, interact, and sendDialogue on a timer. This capability mismatch is security-relevant because users may grant launch-time trust while unknowingly installing continuous behavioral automation with access to local bridge APIs.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file implements a long-running autonomous agent that connects to local WS/HTTP services, makes movement/dialogue decisions, and persists multi-layer memory. This is materially broader than the declared skill purpose of merely opening clawSpace and creates undeclared autonomous behavior that can act on behalf of the user inside the game environment.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code stores daily and curated records of player IDs, names, NPC interactions, goals, locations, and conversation snippets under the user's workspace without clear necessity for a launcher skill. Persistent social/behavioral profiling increases privacy risk and can expose interaction history if local files are accessed by other software or users.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The agent issues autonomous commands over WebSocket and polls perception over HTTP, including move and sendDialogue actions, which exceeds a simple startup/bridge-opening role. This enables undeclared control of an in-game character and could be abused to perform unintended actions whenever the loop is started.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The file implements a persistent memory and profiling subsystem that records conversations, player identities, goals, thoughts, and long-term personality facts, which is materially broader than the stated skill purpose of launching and connecting clawSpace. This creates unnecessary data collection and retention risk, especially because the data is written to disk without any consent, minimization, or access-control safeguards.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The daily memory layer logs raw events including NPC messages, player meetings, goals, and free-form thoughts, then persists them in dated JSON files. For a skill described as an auto-launch/bridge helper, this is over-collection unrelated to the declared function and increases privacy exposure if the local workspace is accessed by other code or users.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The curated memory stores long-term personality traits, key facts, place history, NPC interaction counts, player relationship state, and goal history indefinitely. This is persistent social profiling unrelated to the declared startup workflow, making the mismatch between stated capability and actual behavior more dangerous because users are unlikely to expect or consent to this retention.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: This script starts an autonomous AI loop with a hardcoded player identifier and gameplay goal, then drives the client for 90 seconds without any interactive confirmation or scope restriction. That behavior exceeds the described startup/bridge-launch function of the skill and creates a real risk of unauthorized automated in-game actions if the skill is invoked unexpectedly or by another component.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The activation phrase is broad and presented as sufficient to trigger all startup behavior, but the documentation does not define limits, prerequisites, or exclusions. Ambiguous invocation boundaries can lead to accidental execution of sensitive actions such as starting services and opening external sites.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill says it will automatically start a bridge and open a game in Chrome, but it does not prominently warn that this means spawning local processes and connecting to an external website. Users may invoke it expecting an in-assistant feature rather than local system and network side effects.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The memory/logging design stores and consolidates interaction history without a clear privacy notice, retention statement, or user controls. This is dangerous because the agent may accumulate chat and behavioral records over time in ways the user does not reasonably expect from the skill description.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code reads an API credential from the environment and prepares to send prompts to an external LLM service without any visible disclosure, consent flow, or data-governance controls. In the context of a game bridge, prompts could include player goals, observations, or other local state, creating a privacy and secrets-handling risk if this path is used.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill writes state and memory files to disk in the user's workspace without any visible disclosure or consent mechanism, despite the declared purpose not implying persistent storage. Undisclosed local persistence can leak behavioral data and surprises users about what the skill retains across sessions.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The skill explicitly instructs persistent storage and summarization of observed conversations and interactions into long-term memory and logs. Retaining natural-language histories increases the risk of privacy leakage, secondary use of sensitive data, and disclosure through local file access or later model outputs.

Ssd 3

Medium

Confidence: 93% confidence
Finding: Cross-session loading and persistence of detailed character memory, including prior conversations and contacts, creates an accumulated profile of interactions. Over time this expands the blast radius of any local compromise or accidental disclosure because old data remains available and queryable.

Static analysis

Detected: suspicious.env_credential_access, suspicious.nonstandard_network

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/ai_launcher.js:102

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/ai_loop_ws.js:12

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/ai_loop.js:25

WebSocket connection to non-standard port detected.

Warn

Code: suspicious.nonstandard_network
Location: scripts/ai_loop_ws.js:298